TCP Port 80 Bind Permission Denied Error on Docker Deployment

[Sahil-Poonia]

Hi Team,

I wanted to try Fizzy on my local computer running as a container. So I followed the guide and decided to run it with below config:

container run --rm -p 80:8000 -e SECRET_KEY_BASE=<REDACTED> -e DISABLE_SSL=true -v fizzy:/storage ghcr.io/basecamp/fizzy:main-arm64

And I got below error that says it failed to listen on tcp port 80:

{"time":"2026-07-10T09:23:59.006168292Z","level":"ERROR","msg":"Failed to start HTTP listener","error":"listen tcp :80: bind: permission denied"}

I'm using apple container with kata kernel but I don't think that would be the cause of this issue so I decided to reach out for help.

Thanks

[darekwojciechowski]

Your -p 80:8000 maps host port 80 to container port 8000, but nothing told the app inside to listen on 8000. Thruster defaults to port 80, so it tries to bind :80 inside the container — and the image runs as a non-root user (USER 1000:1000 in the Dockerfile), which isn't allowed to bind ports below 1024.

That's why the error is about :80 even though you thought you'd moved it to 8000.

Set HTTP_PORT to match the container side of your mapping:

container run --rm -p 80:8000 \
  -e HTTP_PORT=8000 \
  -e SECRET_KEY_BASE=<your-key> \
  -e DISABLE_SSL=true \
  -v fizzy:/storage \
  ghcr.io/basecamp/fizzy:main-arm64

Plain Docker usually hides this, because Docker Desktop and most recent distros ship net.ipv4.ip_unprivileged_port_start=0, which lets any user bind low ports. Apple container with the Kata kernel doesn't set that, so you hit the real Linux behaviour. Your instinct that the runtime wasn't the cause was close — it's not causing it, it's just not papering over it.

To confirm once it starts, the log line should show the listener on 8000, and:

curl -I http://localhost/

should give you a response from Fizzy rather than a connection reset.