CentOS Stream 10 – Common Problem 186 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Rootless podman containers cannot bind ports below 1024.

Environment & Reproduction

Default unprivileged port lower bound is 1024.

podman --version
sysctl net.ipv4.ip_unprivileged_port_start

Root Cause Analysis

Kernel sysctl restricts unprivileged sockets to ports >=1024.

Quick Triage

Confirm the current limit and the failing command.

sysctl net.ipv4.ip_unprivileged_port_start
podman run --rm -p 80:80 nginx

Step-by-Step Diagnosis

Lower the unprivileged port floor system-wide.

echo 'net.ipv4.ip_unprivileged_port_start=80' > /etc/sysctl.d/99-podman.conf
sysctl --system

Solution – Primary Fix

Apply the change and retest rootless port binding.

podman run -d -p 80:80 docker.io/library/nginx

Solution – Alternative Approaches

Use a reverse proxy on a privileged port if sysctl changes are not allowed.

dnf install -y nginx && systemctl enable --now nginx

Verification & Acceptance Criteria

Container starts and listens on the requested low port.

ss -ltnp | grep :80

Rollback Plan

Revert the sysctl override.

rm /etc/sysctl.d/99-podman.conf && sysctl --system

Prevention & Hardening

Document low-port policy in the container baseline.

podman info --debug | head -40

Related Errors & Cross-Refs

Permission denied bind, port 80 not allowed.

Related tutorial: View the step-by-step tutorial for centos-stream-10.

View all centos-stream-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Rootless podman docs, sysctl reference.