nerdctl run with --cap-add NET_BIND_SERVICE not working #2439
Description
Description
I have several linuxserver-based containers whose unprivileged services bind to port 80 inside the container, so I can access them through a VPN without having to add port numbers to my URL's. This setup has been working without issue on docker.
Now I'm moving to containerd (docker support is being dropped on truenas scale) and most of my containers fail to bind to port 80.
I modified my run commands to use --cap-add NET_BIND_SERVICE as instructed in the containerd github page, but the containers still fail to bind.
I can use docker inspect on the old containers to confirm that NET_BIND_SERVICE is present, but nerdctl inspect does not return any CapAdd field.
Steps to reproduce the issue
- Configure a container with an unprivileged service that it runs on port 80 internally
- Launch the container using
nerdctl run --cap-add NET_BIND_SERVICE - Watch the initialization logs of the container
Describe the results you received and expected
I expected the unprivileged service to bind to port 80 / 443, but it doesn't.
What version of nerdctl are you using?
1.5.0
Are you using a variant of nerdctl? (e.g., Rancher Desktop)
None
Host information
Client:
Namespace: default
Debug Mode: false
Server:
Server Version: 1.6.8
Storage Driver: overlayfs
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Log: fluentd journald json-file syslog
Storage: native overlayfs zfs
Security Options:
apparmor
seccomp
Profile: default
cgroupns
Kernel Version: 5.15.107+truenas
Operating System: Debian GNU/Linux 11 (bullseye)
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 15.41GiB