photoview compose service unable to use port 80 on some systems: tcp 80 bind permission denied

[ky0utarou]

The compose file used is the minimal one, but used the image viktorstrate/photoview:master
Got the following error

goroutine 1 [running]:
log.Panic({0xc000145f20?, 0xff56e5?, 0xffffffffffffffff?})
	/usr/lib/go-1.19/src/log/log.go:388 +0x65
main.main()
	/app/server.go:122 +0xc25
2024/06/02 15:25:59 Starting Photoview...
2024/06/02 15:25:59 No .env file found
2024/06/02 15:25:59 Utilizing mysql database driver based on environment variables
2024/06/02 15:25:59 Initializing scanner queue with 3 workers
2024/06/02 15:25:59 Queue waiting
2024/06/02 15:25:59 Periodic scan interval changed: disabled
2024/06/02 15:25:59 Scan interval runner: Waiting for signal
2024/06/02 15:25:59 Scan interval runner: New ticker detected
2024/06/02 15:25:59 Scan interval runner: Waiting for signal
2024/06/02 15:25:59 Found executable worker: darktable (darktable 4.6.1)
2024/06/02 15:25:59 Found executable worker: ffmpeg (ffmpeg version 5.1.4-0+deb12u1 Copyright (c) 2000-2023 the FFmpeg developers)
2024/06/02 15:25:59 Found exiftool
2024/06/02 15:25:59 Initializing face detector
2024/06/02 15:25:59 Photoview API endpoint listening at http://photoview:80/api
2024/06/02 15:25:59 Photoview API public endpoint ready at /api
2024/06/02 15:25:59 Photoview UI public endpoint ready at /
2024/06/02 15:25:59 listen tcp :80: bind: permission denied
panic: listen tcp :80: bind: permission denied
goroutine 1 [running]:
log.Panic({0xc00036bf20?, 0xff56e5?, 0xffffffffffffffff?})
	/usr/lib/go-1.19/src/log/log.go:388 +0x65
main.main()
	/app/server.go:122 +0xc25

So it seems the latest version is not compatible to old configurations. Just wondering any plan to give example configurations with newer versions of images?

Thanks

[kkovaletp]

@ky0utarou, thanks for the report.
This issue is not related to the compose file. It is caused by the default privileged port in the image, while the image is configured to run in non-root mode by default. Relatively new versions of docker allow to use it as an exception from the default Linux port management policy, but in some cases, it doesn't.

Please let us know what is your version of Docker and on which host it is installed:

• Is it some proprietary device, like NAS or Media Center, that can host users' dockerized services?
• do you use some orcestration service (k8s, swarm, etc.)?
• what is your OS, version, architecture (x86-64, ARM), and some other specifics of your setup?

Basically, we had a discussion about this potential issue in the scope of the #863 PR review. The decision was made to go with port 80 as the default, as it should work for most cases.

However, there is an easy fix for you and everybody else, who is facing the same issue:

• Add (in the case of minimal compose) or uncomment (in the case of the default compose) the next line in the environment section of the photoview service:
  PHOTOVIEW_LISTEN_PORT: 80
• Change the value from 80 to some free unprivileged port, for instance, 8080
• Change the port mapping of the service from 8000:80 to 8000:<the new port from the previous step>
• Run docker-compose down, followed by docker-compose up -d (or make down start if you use Makefile, provided in the examples)
  Once the container is recreated with a new port, it should work fine.

@viktorstrate FYI

[ky0utarou]

Your solution works. Thanks!

My host is a Synology with Docker version 20.10.3, build 55f0773 and without orchestration. It's x86 linux with 4.4.180+ kernel.

It is caused by the default privileged port in the image, while the image is configured to run in non-root mode by default. Relatively new versions of docker allow to use it as an exception from the default Linux port management policy, but in some cases, it doesn't.

you mean it's due to docker or the docker image? I'm not very familiar with docker, just wondering

[kkovaletp]

My host is a Synology with Docker version 20.10.3, build 55f0773 and without orchestration. It's x86 linux with 4.4.180+ kernel.

I'm not sure whether it is caused by Synology, the old kernel version, or the old Docker version. Try to update your Docker version using the standard software update flow. If it tells you that this is the newest available version of Docker, available for your system, and there is nothing to update, then it means that the newer version needs a newer kernel and you have to upgrade your Synology version to get the newer kernel version - I don't know whether it even exists.

it's due to docker or the docker image?

The issue with the port is caused by the Docker version on your host. Our image relies on the Docker port management rules, available in newer Docker versions (I don't know in which exact version they implemented this, but it works in the latest versions). Older Docker versions follow Linux standard port management rules, so according to them non-root user (which runs our server app inside the container) cannot bind privileged ports (including port 80).

Hope that this explanation makes it more clear for you.

[ky0utarou]

The issue with the port is caused by the Docker version on your host. Our image relies on the Docker port management rules, available in newer Docker versions (I don't know in which exact version they implemented this, but it works in the latest versions). Older Docker versions follow Linux standard port management rules, so according to them non-root user (which runs our server app inside the container) cannot bind privileged ports (including port 80).

This really clarifies the situation. Thanks a lot