Allowing node.js applications to run on port 80

Question

I'm following a walkthrough that guides you through setting up node on an ubuntu machine. I'm at the step where you configure the system to allow node to run on port 80. It (as well as a few other guides I've looked at) recommend running the following command:

sudo setcap cap_net_bind_service=+ep /usr/local/bin/node

This returns the following error:

Failed to set capabilities on file `/usr/local/bin/node' (Invalid argument)
The value of the capability argument is not permitted for a file. Or the file is not a regular (non-symlink) file

Any idea what may cause this error?

Solution 1

in order to avoid this error, you can resolve the non-symlink executable with which node, as full example:

sudo apt-get install libcap2-bin
sudo setcap cap_net_bind_service=+ep `readlink -f \`which node\``

the "which" command shows the full path of shell commands.

Solution 2

Figured it out. Turns out however I installed node, created a sym-link in /usr/bin/node which pointed to another sym-link in /etc/alternatives/node which pointed to another sym-link in /usr/bin/nodejs.

Running the command against /usr/bin/nodejs worked.

Solution 3

FWIW, another option is to use authbind. Authbind uses a slightly different mechanism to achieve similar ends to CAP_NET_BIND_SERVICE. I.e. allows non-privileged apps to use privileged ports.

Install from apt:

sudo apt-get update && sudo apt-get install authbind

Assuming the desired app.js is running under non-privileged user "user" and you wish to bind to port 80:

sudo touch /etc/authbind/byport/80
sudo chown user:user /etc/authbind/byport/80
sudo chmod 500 /etc/authbind/byport/80

Then run your app like this:

authbind node app.js

If you instead wish to use something like "forever" (essentially daemonizes node apps), then this is the go:

authbind --deep forever app.js

Solution 4

One reason the setcap command sometimes fails is because certain file systems do not support it, if they don't support extended attributes.

The filesystem must support attaching capabilities to an executable file, so that a process gains those capabilities when the file is executed.

http://man7.org/linux/man-pages/man7/capabilities.7.html

This is especially true with Docker. Docker uses the BTRFS or AUFS storage backends, but can also user overlayfs. Overlayfs supports setting caps, but BTRFS and AUFS (see below) do not.

https://github.com/moby/moby/issues/30557

If you need to run images with AUFS, you must be running a kernel with CONFIG_AUFS_XATTR=y.

For this reason authbind is often a better solution.

View more solutions

Comments

[Marc van Nieuwenhuijzen]

Only answer that solved it

[steampowered]

Another article endorsing the authbind solution for node medium.com/@steve.mu.dev/setup-authbind-on-mac-os-6aee72cb82‌​8

[Jeremy Davis]

Thanks for the edit fixing my omission @brodybits! :)