Default net.ipv4.ip_unprivileged_port_start to 0 inside containers #4615

yashkukrecha · 2025-11-24T21:52:04Z

This PR makes nerdctl default the container's net.ipv4.ip_unprivileged_port_start sysctl to 0, unless the user has explicitly set this sysctl via --sysctl.

Key changes:

Adds a new helper withDefaultUnprivilegedPortSysctl in pkg/cmd/container/container.go.
Applies this helper during container creation, after user-supplied sysctls are parsed.
If the user passes a --sysctl for net.ipv4.ip_unprivileged_port_start, nerdctl does not override it.

Note: Host-wide sysctl configuration and containerd-rootless-setuptool.sh were intentionally left unchanged in this PR to keep the scope focused on the container namespace default requested in the issue.

Fixes #4595

docs/faq.md

AkihiroSuda · 2025-11-26T03:51:40Z

pkg/cmd/container/create.go

 	opts = append(opts, umaskOpts...)

+	if !isHostNetwork(netLabelOpts) {
+		opts = append(opts, withDefaultUnprivilegedPortSysctl(options.Sysctl))


conflicts with:

nerdctl/pkg/cmd/container/run_linux.go

Line 100 in 1d69ed9

opts = append(opts, WithSysctls(strutil.ConvertKVStringsToMap(options.Sysctl)))

I added the defaulting for net.ipv4.ip_unprivileged_port_start in create.go, building on top of the behavior in run_linux.go. Does this still conflict?

pkg/cmd/container/create.go

pkg/cmd/container/create_unprivileged_sysctl_test.go

pkg/cmd/container/create.go

AkihiroSuda · 2025-11-27T10:33:25Z

Please fix the lint errors, squash the commits, and sign off the DCO

…iners Signed-off-by: Yash Kukrecha <ykukrecha@gmail.com>