HAProxy Ports 80 and 443 Permission Denied

[bryanheinz]

I'm attempting to run a HAProxy container, binding to ports 80 and 443. However, I'm getting a Permission Denied error when it tries to bind to the ports:

haproxy |[ALERT] (1) : Binding [/usr/local/etc/haproxy/haproxy.cfg:20] for frontend http-in: cannot bind socket (Permission denied) for [0.0.0.0:80]

My host is macOS 13. New Colima install, fairly vanilla config. I haven't touched the network config. Colima appears to have pulled Ubuntu 23.10 by default.

colima status:

INFO[0000] colima is running using macOS Virtualization.Framework
INFO[0000] arch: aarch64
INFO[0000] runtime: containerd
INFO[0000] mountType: virtiofs

Recreation:

• Install Colima on macOS 13
• Config to use the macOS virtualization framework and filesystem
• Run a HAProxy container that binds to 80 and/or 443

I've been searching all over and I can't seem to come up with a solution. I don't think that this is an uncommon use case and the fact that i can't find anyone else with this problem means that I'm probably missing something simple. Maybe it's just the layers of abstraction that are messing me up. Any help is greatly appreciated.

[abiosoft]

@bryanheinz can you share your docker run command?

[bryanheinz]

Of course, albeit I'm using Compose.

version: "3"

networks:
    frontend:
        external: true

volumes:
    haproxy_certs:
        external: true

services:
    haproxy:
        image: haproxy:2.8-alpine
        ports:
            - 80:80
            - 443:443
        volumes:
            - ./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
            - haproxy_certs:/haproxy
        container_name: haproxy
        networks:
            frontend:
                aliases:
                    - haproxy

[abiosoft]

Can you share a sample haproxy.cfg file?

[bryanheinz]

Sure thing. I put one in a gist here.

[abiosoft]

I was able to start it successfully without seeing those errors. Do you have something else running on port 80?

Can you try running another container that utilises port 80. e.g.

docker run --rm -it -p 80:80 caddy

Or maybe check if anything is using port 80.

lsof -nP -iTCP:80 | grep LISTEN

[bryanheinz]

As far as I can tell, nothing is or should be running on 80 or 443. I just bounced the host to be sure and I ran the lsof command and nothing came back. I ran lsof against another port that I expected to be up and got a result just to validate.

I tried Caddy and it worked 😵

I tried switching over the the Debian HAProxy image and I'm still getting the same permission denied. FYI I'm using nerdctl. I'm not sure if that makes a difference or not. This exact HAProxy config and compose file do work with the Docker Desktop app which I'm trying to move away from.

This really doesn't make sense to me. If Caddy works without issue here, and you can run HAProxy, I don't understand how I end up with a permission denied trying to run HAProxy 😵‍💫

I don't need to be running colima and nerdctl via sudo on macOS, do I?

Thanks for your help, I really appreciate it.

-bryan

[abiosoft]

You definitely do not need to run as root (with sudo) on macOS.