Rootless Docker: Troubleshooting Common Networking Issues

- [`--net=host` doesn't listen ports on the host network namespace](#--nethost-doesnt-listen-ports-on-the-host-network-namespace) - [Network is slow](#network-is-slow) - [`docker run -p` does not propagate source IP addresses](#docker-run--p-does-not-propagate-source-ip-addresses) #### `docker run -p` fails with `cannot expose privileged port` `docker run -p` fails with this error when a privileged port (< 1024) is specified as the host port. ```console $ docker run -p 80:80 nginx:alpine docker: Error response from daemon: driver failed programming external connectivity on endpoint focused_swanson (9e2e139a9d8fc92b37c36edfa6214a6e986fa2028c0cc359812f685173fa6df7): Error starting userland proxy: error while calling PortManager.AddPort(): cannot expose privileged port 80, you might need to add "net.ipv4.ip_unprivileged_port_start=0" (currently 1024) to /etc/sysctl.conf, or set CAP_NET_BIND_SERVICE on rootlesskit binary, or choose a larger port number (>= 1024): listen tcp 0.0.0.0:80: bind: permission denied. ``` When you experience this error, consider using an unprivileged port instead. For example, 8080 instead of 80. ```console $ docker run -p 8080:80 nginx:alpine ``` To allow exposing privileged ports, see [Exposing privileged ports](#exposing-privileged-ports). #### Ping doesn't work Ping does not work when `/proc/sys/net/ipv4/ping_group_range` is set to `1 0`: ```console $ cat /proc/sys/net/ipv4/ping_group_range 1 0 ``` For details, see [Routing ping packets](#routing-ping-packets). #### `IPAddress` shown in `docker inspect` is unreachable This is an expected behavior, as the daemon is namespaced inside RootlessKit's network namespace. Use `docker run -p` instead. #### `--net=host` doesn't listen ports on the host network namespace This is an expected behavior, as the daemon is namespaced inside RootlessKit's network namespace. Use `docker run -p` instead. #### Network is slow Docker with rootless mode uses [slirp4netns](https://github.com/rootless-containers/slirp4netns) as the default network stack if slirp4netns v0.4.0 or later is installed. If slirp4netns is not installed, Docker falls back to [VPNKit](https://github.com/moby/vpnkit). Installing slirp4netns may improve the network throughput. For more information about network drivers for RootlessKit, see [RootlessKit documentation](https://github.com/rootless-containers/rootlesskit/blob/v2.0.0/docs/network.md).

This section provides solutions to common networking problems in Rootless Docker. It explains how to resolve the `cannot expose privileged port` error by using unprivileged ports or adjusting system settings. It also addresses why ping might not work due to `/proc/sys/net/ipv4/ping_group_range` settings. The document clarifies that the IP address shown in `docker inspect` is unreachable and `--net=host` doesn't listen on the host network namespace due to RootlessKit's network namespace. Finally, it discusses slow network performance and suggests installing slirp4netns to improve throughput, referencing RootlessKit's network documentation for more details.