Skip to content

Fix port binding with reduced privileges #3574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 1, 2025
Merged

Conversation

sjberman
Copy link
Collaborator

@sjberman sjberman commented Jul 1, 2025

Problem: The nginx deployment was using extra privileges in order to bind to privileged ports (<1024). This included allowPrivilegeEscalation and NET_BIND_SERVICE. Sometimes this could cause issues in some secure environments.

Solution: Remove these extra privileges and take advantage of sysctls to lower the allowed port range for the pod its defined on.

Testing: Verified that everything still works, including in OpenShift.

Closes #3567

Checklist

Before creating a PR, run through this checklist and mark each as complete.

  • I have read the CONTRIBUTING doc
  • I have added tests that prove my fix is effective or that my feature works
  • I have checked that all unit tests pass after adding my changes
  • I have updated necessary documentation
  • I have rebased my branch onto main
  • I will ensure my PR is targeting the main branch and pulling from my branch from my own fork

Release notes

If this PR introduces a change that affects users and needs to be mentioned in the release notes,
please add a brief note that summarizes the change.

Fix port binding with reduced privileges.

Problem: The nginx deployment was using extra privileges in order to bind to privileged ports (<1024). This included `allowPrivilegeEscalation` and `NET_BIND_SERVICE`.

Solution: Remove these extra privileges and take advantage of `sysctls` to lower the allowed port range for the pod its defined on.
@sjberman sjberman requested a review from a team as a code owner July 1, 2025 19:08
@github-actions github-actions bot added bug Something isn't working helm-chart Relates to helm chart labels Jul 1, 2025
Copy link

codecov bot commented Jul 1, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 86.86%. Comparing base (a523d21) to head (d461ded).
Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #3574      +/-   ##
==========================================
- Coverage   86.89%   86.86%   -0.04%     
==========================================
  Files         127      127              
  Lines       15220    15226       +6     
  Branches       62       62              
==========================================
  Hits        13226    13226              
- Misses       1843     1848       +5     
- Partials      151      152       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Contributor

@salonichf5 salonichf5 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀

@sjberman sjberman merged commit 573828e into main Jul 1, 2025
104 of 106 checks passed
@sjberman sjberman deleted the fix/privileged-ports branch July 1, 2025 22:18
@github-project-automation github-project-automation bot moved this from 🆕 New to ✅ Done in NGINX Gateway Fabric Jul 1, 2025
sjberman added a commit that referenced this pull request Jul 3, 2025
sjberman added a commit that referenced this pull request Jul 3, 2025
Problem: The nginx deployment was using extra privileges in order to bind to privileged ports (<1024). This included `allowPrivilegeEscalation` and `NET_BIND_SERVICE`. Sometimes this could cause issues in some secure environments.

Solution: Remove these extra privileges and take advantage of `sysctls` to lower the allowed port range for the pod its defined on.
sjberman added a commit that referenced this pull request Jul 3, 2025
Problem: The nginx deployment was using extra privileges in order to bind to privileged ports (<1024). This included `allowPrivilegeEscalation` and `NET_BIND_SERVICE`. Sometimes this could cause issues in some secure environments.

Solution: Remove these extra privileges and take advantage of `sysctls` to lower the allowed port range for the pod its defined on.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working helm-chart Relates to helm chart release-notes
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

Unable to bind to privileged ports
3 participants