Repository navigation
[BUG] image produced lacks capabilities flag on syslog-ng binary #36
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
With a default installation ports below 1024 receive a permissions denied error
2025-10-26 08:01:55.641557113 [2025-10-26T08:01:55.641490] Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Permission denied (13)'
2025-10-26 08:01:55.641563052 [2025-10-26T08:01:55.641490] Error initializing message pipeline; plugin_name='syslog', location='/config/sources.conf:6:3'
Expected Behavior
Ports defined should be bound to, and not receive a permissions error.
Steps To Reproduce
- install image via docker by listed command below:
- define the following source:
source s_514tcp {
syslog(transport(tcp) port(514));
};
- receive error, and the server fails to start.
Environment
- OS: Gentoo Linux
- How docker service was installed: PortageCPU architecture
x86-64
Docker creation
docker run \
-it \
--name somehostname \
--network host \
--tmpfs /tmp \
-p 514:514 -p 514:514/udp -p 5514:5514/udp -p 6601:6601 -p 6514:6514 \
-v /local-configs:/config:z \
linuxserver/syslog-ng:latestContainer logs
───────────────────────────────────────
██╗ ███████╗██╗ ██████╗
██║ ██╔════╝██║██╔═══██╗
██║ ███████╗██║██║ ██║
██║ ╚════██║██║██║ ██║
███████╗███████║██║╚██████╔╝
╚══════╝╚══════╝╚═╝ ╚═════╝
Brought to you by linuxserver.io
───────────────────────────────────────
To support LSIO projects visit:
https://www.linuxserver.io/donate/
───────────────────────────────────────
GID/UID
───────────────────────────────────────
User UID: 911
User GID: 911
───────────────────────────────────────
Linuxserver.io version: 4.8.3-r1-ls173
Build-date: 2025-10-23T19:01:10+00:00
───────────────────────────────────────
[custom-init] No custom files found, skipping...
crond[167]: crond (busybox 1.37.0) started, log level 5
crond[167]: user:root entry:*/15 * * * * run-parts /etc/periodic/15min
crond[167]: user:root entry:0 * * * * run-parts /etc/periodic/hourly
crond[167]: user:root entry:0 2 * * * run-parts /etc/periodic/daily
crond[167]: user:root entry:0 3 * * 6 run-parts /etc/periodic/weekly
crond[167]: user:root entry:0 5 1 * * run-parts /etc/periodic/monthly
[ls.io-init] done.
[migrations] started
[migrations] no migrations found
usermod: no changes
crond[171]: wakeup dt=10
crond[171]: file root:
crond[171]: line run-parts /etc/periodic/15min
crond[171]: line run-parts /etc/periodic/hourly
crond[171]: line run-parts /etc/periodic/daily
crond[171]: line run-parts /etc/periodic/weekly
crond[171]: line run-parts /etc/periodic/monthly
crond[171]: wakeup dt=60
crond[171]: file root:
crond[171]: line run-parts /etc/periodic/15min
crond[171]: line run-parts /etc/periodic/hourly
crond[171]: line run-parts /etc/periodic/daily
crond[171]: line run-parts /etc/periodic/weekly
crond[171]: line run-parts /etc/periodic/monthly
...
Activity
github-actions commentedon Oct 26, 2025
Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.
rmackinnon commentedon Oct 26, 2025
The core issue here is that the linux capabilities flag for the binary are not set at installation/build to allow the UID 911 to run at ports below 1024. Therefore the solution is pretty straight forward with an update to the Dockerfile to build the image with the following after building/installing syslog-ng:
The work-around until then is to apply the following to the container manually:
By setting only this effective and permissive capability, the daemon is allowed by the kernel to open ports lower than 1024 without having to run as root.
LinuxServer-CI commentedon Nov 26, 2025
This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.
rmackinnon commentedon Nov 26, 2025
There has been no response to this issue from a contributor.
thespad commentedon Dec 26, 2025
You're running this in host networking mode, so the port mappings have no effect.
The reason the shipped config is configured the way it is with the ports it uses is to avoid issues with privileged ports inside the container; Docker itself (as long as you're running a supported version) will allow you to map bridged ports below 1024 as an unprivileged user but in host networking mode you're leveraging the host networking stack so Docker doesn't get involved in the process.
LinuxServer-CI commentedon Jan 26, 2026
This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.
LinuxServer-CI commentedon Apr 26, 2026
This issue is locked due to inactivity