Error message shown when starting lima instance (`[hostagent] failed to listen udp: listen udp 127.0.0.1:323: bind: permission denied `)

[afbjorklund]

Description

On Linux, a red error message is shown for NTP (UDP 323)

INFO[0018] [hostagent] Forwarding UDP from 0.0.0.0:5353 to 127.0.0.1:5353 
INFO[0018] [hostagent] Not forwarding UDP 127.0.0.54:53 
INFO[0018] [hostagent] Not forwarding UDP 127.0.0.53:53 
INFO[0018] [hostagent] Not forwarding UDP 192.168.5.15:68 
INFO[0018] [hostagent] Forwarding UDP from 127.0.0.1:323 to 127.0.0.1:323 
INFO[0018] [hostagent] Forwarding UDP from [::]:5353 to 127.0.0.1:5353 
ERRO[0018] [hostagent] failed to listen udp: listen udp 127.0.0.1:323: bind: permission denied 
INFO[0018] [hostagent] Forwarding UDP from [::1]:323 to 127.0.0.1:323 
ERRO[0018] [hostagent] failed to listen udp: listen udp 127.0.0.1:323: bind: permission denied 

Possibly related to portforwarding:

• Review default portforwarding rules #4193

[afbjorklund]

Darwin

       if !localIP.Equal(IPv4loopback1) || localPort >= 1024 {
               udpConn, err := listenConfig.ListenPacket(ctx, "udp", hostAddress)
               if err != nil {
                       logrus.Errorf("failed to listen udp: %v", err)
                       return nil, err
               }
               return udpConn, nil
       }

Linux

        udpConn, err := ListenPacket(ctx, p.listenConfig, hostAddress)
        if err != nil {
                logrus.Errorf("failed to listen udp: %v", err)
                p.udpListenersRW.Unlock()
                return
        }

[danrot]

On macOS 26.1 I get a similar error for a different port (5353). Seems like that port is already occupied by mDNSResponder. There is another warning about a vsock port, but I think that is something unrelated. After looking that one up a bit it sounds like current ubuntu lts does not support vsock, so I guess this warning should be gone after the next dist-upgrade.

INFO[0000] Using the existing instance "default"        
INFO[0000] Starting the instance "default" with internal VM driver "vz" 
INFO[0000] [hostagent] hostagent socket created at /Users/danielrotter/.lima/default/ha.sock 
INFO[0000] [hostagent] Starting VZ (hint: to watch the boot progress, see "/Users/danielrotter/.lima/default/serial*.log") 
INFO[0000] [hostagent] Setting up Rosetta share         
INFO[0000] [hostagent] [VZ] - vm state change: running  
WARN[0008] [hostagent] Failed to detect SSH server on vsock port, falling back to usernet forwarder  error="Error Domain=NSPOSIXErrorDomain Code=54 Description=\"The operation couldn’t be completed. Connection reset by peer\" UserInfo={\n}"
INFO[0010] SSH Local Port: 60022                        
INFO[0009] [hostagent] Waiting for the essential requirement 1 of 3: "ssh" 
INFO[0009] [hostagent] The essential requirement 1 of 3 is satisfied 
INFO[0009] [hostagent] Waiting for the essential requirement 2 of 3: "user session is ready for ssh" 
INFO[0010] [hostagent] The essential requirement 2 of 3 is satisfied 
INFO[0010] [hostagent] Waiting for the essential requirement 3 of 3: "Explicitly start ssh ControlMaster" 
INFO[0010] [hostagent] The essential requirement 3 of 3 is satisfied 
INFO[0010] [hostagent] Waiting for the optional requirement 1 of 1: "user probe 1/1" 
INFO[0010] [hostagent] Forwarding "/run/user/502/docker.sock" (guest) to "/Users/danielrotter/.lima/default/sock/docker.sock" (host) 
INFO[0010] [hostagent] The optional requirement 1 of 1 is satisfied 
INFO[0010] [hostagent] Waiting for the guest agent to be running 
INFO[0010] [hostagent] Guest agent is running           
INFO[0010] [hostagent] Waiting for the final requirement 1 of 1: "boot scripts must have finished" 
INFO[0010] [hostagent] Not forwarding TCP 0.0.0.0:22    
INFO[0010] [hostagent] Not forwarding TCP 127.0.0.53:53 
INFO[0010] [hostagent] Not forwarding TCP 127.0.0.54:53 
INFO[0010] [hostagent] Not forwarding TCP [::]:22       
INFO[0010] [hostagent] Not forwarding UDP 127.0.0.54:53 
INFO[0010] [hostagent] Not forwarding UDP 127.0.0.53:53 
INFO[0010] [hostagent] Not forwarding UDP 192.168.5.15:68 
INFO[0010] [hostagent] Forwarding UDP from 0.0.0.0:5353 to 127.0.0.1:5353 
INFO[0010] [hostagent] Forwarding UDP from [::]:5353 to 127.0.0.1:5353 
ERRO[0010] [hostagent] failed to listen udp: listen udp 127.0.0.1:5353: bind: address already in use 
ERRO[0010] [hostagent] failed to listen udp: listen udp 127.0.0.1:5353: bind: address already in use 
ERRO[0010] [hostagent] failed to listen udp: listen udp 127.0.0.1:5353: bind: address already in use 
ERRO[0010] [hostagent] failed to listen udp: listen udp 127.0.0.1:5353: bind: address already in use 
INFO[0013] [hostagent] The final requirement 1 of 1 is satisfied 
INFO[0013] READY. Run `lima` to open the shell.

I am using lima mainly for docker, and everything is still working there. The errors are still annoying though.

[jandubois]

As I mentioned elsewhere, I'm not convinced that automatically forwarding all UDP connections to the host is the right thing to do.

If we want to continue to do so, maybe we should at least remove some well-known UDP ports that we know will be unavailable because a host service is already using them (53, 5353 for mDNSresponder, 323 for NTP, others?).

This would be easy to do by adding corresponding ignore default rules. The user could still try to override explicitly if they somehow manage to kill the corresponding host daemons.

But let's discuss first if forwarding UDP connections automatically was the right thing to do!

[jandubois]

I just realized we maybe should have discussed this at the meeting yesterday:

Do we want to disable UDP by default again?

Or do we want to just disable certain well-known ports? But which ones? Where do we draw the line? Block all privileged ports, and 5353?

Comment from Slack today:

i do not expect or want UDP port forwarding to happen when i'm trying to start the Docker template...

[AkihiroSuda]

Do we want to disable UDP by default again?

I'd prefer to treat TCP and UDP equally; all the ports can be forwarded by default unless there is an exceptional reason.

Let's just decrease the log level to the debug level and call it a day

[jandubois]

Let's just decrease the log level to the debug level and call it a day

I would not want to hide failed TCP forwards. E.g if I run a web server on port 80 in the guest, and have also python3 -m http.server 80 running in some shell on the host, then I want to know about this.

The difference is that TCP listening ports inside the guest are normally from user space, whereas most of the UDP ports are likely system processes.

If we want to keep UDP enabled by default, maybe we should have an option to disable it on start:

limactl start docker --no-udp

I have no good suggestions for the name though, needs some bike-shedding. --no-udp sounds wrong to me, that should be --udp=false, which I also don't like. --without-udp is pretty long, --udp-none would be similar to --mount-none, but also doesn't feel right to me.

[AkihiroSuda]

Maybe we can hard-code this system port list https://support.apple.com/en-us/103229 to silence errors

[afbjorklund]

The main goal of the issue was to avoid having red ERROR messages shown to the user by default.

[danrot]

For me personally it would be fine to just forward all ports by default, as long as I can disable them on my own, but I haven't managed to do that so far. So I think it would be nice if somebody could show the required configuration to do so in here (especially for the docker template in my case).

[nlordell]

I don't use the docker template (I use the fedora-43 one), but I managed to silence all the errors with this additional configuration:

portForwards:
- guestIP: "::"
  guestPort: 323
  proto: udp
  ignore: true
- guestIP: "::"
  guestPort: 5353
  proto: udp
  ignore: true
- guestIP: "::"
  guestPort: 5355
  proto: any
  ignore: true

As a side note - I wasn't sure why I needed to specify a guestIp; I would have expected that omitting it would mean "either 127.0.0.1, ::1, 0.0.0.0, or ::", but it didn't work as expected (at least, that is how I interpreted the documentation in the default template).

[danrot]

@nlordell Thank you, that did the trick of me!