[BUG] permission denied 0.0.0.0:80 running latest connector docker image (6.14.3)

[akramer-zibra]

Describe the bug
We use the connector in a docker setup for wallet-integration and latest image version (e.g. 6.14.3) exists with permission denied 0.0.0.0:80 error.

connector  | [2025-02-11T10:31:19.062] [INFO] Transport.Transport - Transport initialized
connector  | [2025-02-11T10:31:20.408] [INFO] DatabaseSchemaUpgrader.v1 - Upgrading database schema to version 1 for account 'did:e:nmshd-bkb.demo.meinbildungsraum.de:dids:a1bdce0e46c009ac8fe511'
connector  | [2025-02-11T10:31:20.425] [INFO] DatabaseSchemaUpgrader.v2 - Upgrading database schema to version 2 for account 'did:e:nmshd-bkb.demo.meinbildungsraum.de:dids:a1bdce0e46c009ac8fe511'
connector  | [2025-02-11T10:31:20.429] [INFO] ConnectorRuntime - Loading modules...
connector  | [2025-02-11T10:31:20.431] [INFO] ConnectorRuntime - Module 'Auto Accept Pending Relationships' was loaded successfully.
connector  | [2025-02-11T10:31:20.434] [INFO] ConnectorRuntime - Module 'Core HTTP API' was loaded successfully.
connector  | [2025-02-11T10:31:20.435] [INFO] ConnectorRuntime - Module 'Sync' was loaded successfully.
connector  | [2025-02-11T10:31:20.437] [INFO] ConnectorRuntime - Initializing modules...
connector  | [2025-02-11T10:31:20.437] [INFO] ConnectorRuntime - Module 'Notification Module' was initialized successfully.
connector  | [2025-02-11T10:31:20.437] [INFO] ConnectorRuntime - Module 'Decider Module' was initialized successfully.
connector  | [2025-02-11T10:31:20.437] [INFO] ConnectorRuntime - Module 'Request Module' was initialized successfully.
connector  | [2025-02-11T10:31:20.437] [INFO] ConnectorRuntime - Module 'Attribute Listener' was initialized successfully.
connector  | [2025-02-11T10:31:20.437] [INFO] ConnectorRuntime - Module 'Auto Accept Pending Relationships' was initialized successfully.
connector  | [2025-02-11T10:31:20.536] [INFO] ConnectorRuntime - Module 'Core HTTP API' was initialized successfully.
connector  | [2025-02-11T10:31:20.536] [INFO] ConnectorRuntime - Module 'Sync' was initialized successfully.
connector  | [2025-02-11T10:31:20.603] [WARN] HttpServer - The configured API key does not meet the requirements. It must be at least 30 characters long and contain at least 2 digits, 2 uppercase letters, 2 lowercase letters and 1 special character (!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~]).
connector  | [2025-02-11T10:31:20.603] [WARN] HttpServer - The API key will be used as is, but it is recommended to change it as it will not be supported in future versions.
connector  | [2025-02-11T10:31:20.688] [ERROR] ConnectorRuntime - Uncaught exception occured:  Error: listen EACCES: permission denied 0.0.0.0:80
connector  |     at Server.setupListenHandle [as _listen2] (node:net:1915:21)
connector  |     at listenInCluster (node:net:1994:12)
connector  |     at Server.listen (node:net:2099:7)
connector  |     at Function.listen (/usr/app/node_modules/express/lib/application.js:635:24)
connector  |     at /usr/app/dist/infrastructure/httpServer/HttpServer.js:223:36
connector  |     at new Promise (<anonymous>)
connector  |     at HttpServer.start (/usr/app/dist/infrastructure/httpServer/HttpServer.js:221:22)
connector  |     at ConnectorRuntime.startInfrastructure (/usr/app/dist/ConnectorRuntime.js:282:34)
connector  |     at ConnectorRuntime.start (/usr/app/node_modules/@nmshd/runtime/dist/Runtime.js:277:20)
connector  |     at Object.startConnectorHandler [as handler] (/usr/app/dist/cli/commands/startConnector.js:12:19) {
connector  |   code: 'EACCES',
connector  |   errno: -13,
connector  |   syscall: 'listen',
connector  |   address: '0.0.0.0',
connector  |   port: 80
connector  | }

To Reproduce
docker-compose.yml:

volumes:
  mongodb_data:

networks:
  connector_network:
    driver: bridge

services:
  connector:
    container_name: connector
    image: ghcr.io/nmshd/connector:6.14.3 
    environment:
      CUSTOM_CONFIG_LOCATION: "/config.json"
    ports:
      - 8080:80
    volumes:
      - ./config.json:/config.json:ro
    depends_on:
      - mongodb
    restart: on-failure
    networks:
      - connector_network

  mongodb:
    container_name: mongodb
    image: mongo:latest
    expose:
      - 27017
    environment:
      MONGO_INITDB_ROOT_USERNAME: connector
      MONGO_INITDB_ROOT_PASSWORD: ***********
      TZ: Europe/Berlin
    volumes:
      - mongodb_data:/data/db
    extra_hosts:
      - "host.docker.internal:host-gateway"
    restart: on-failure
    networks:
      - connector_network

config.json

{
    "debug": true,
    "transportLibrary": {
        "baseUrl": "https://***********",
        "platformClientId": "***********",
        "platformClientSecret": "***********"
    },
    "database": {
        "connectionString": "mongodb://connector:***********@mongodb:27017/?authSource=admin&readPreference=primary&ssl=false",
        "dbName": "enmeshed"
    },
    "infrastructure": {
        "httpServer": {
            "apiKey": "***********"
        }
    },
    "modules": {
        "coreHttpApi": {
            "docs": {
                "enabled": true
            }
        },
        "sync": {
            "enabled": true,
            "interval": 60
        },
        "autoAcceptPendingRelationships": {
            "enabled": true
        }
    }
}

NOTICE: credentials are masked and must be replaced with valid values before testing

Steps to reproduce the behavior:
1.) docker compose pull
2.) docker compose up

Expected behavior
The connector process should not exit with a permission denied error.

Environment

• Product: Connector
• Version: 6.14.3
• Host: Windows 10 (docker host)

[jkoenig134]

Hey - seems like you run rootless docker or we broke something.

Please add

{
    "infrastructure": {
        "httpServer": {
            "port": 8080
        }
    }
}

to your config.json and change your port mapping in the compose file from 8080:80 to 8080:8080, to fix the problem for now.

[akramer-zibra]

seems like you run rootless docker or we broke something.

Yes, we are running rootless docker. I simplified the configuration above.

Switching to port 8080 with the config.json will solve our issue. Thanks @jkoenig134!

...or we broke something

Something may have changed with the last updates. We previously pinned the connector image to 6.13.0 which allows 80 port to listen to and runs without permission errors. But I do not know, if this was the last version without this issue 🤔.

I'll close this issue, cause our issue is solved.
Best regards