From ae765a09c56e16c4727392afa5692bbfa7f60c55 Mon Sep 17 00:00:00 2001 From: jnfrati Date: Wed, 23 Sep 2026 17:29:33 +0200 Subject: [PATCH] [proxy] Serve UBI http-01 challenges on an unprivileged port The challenge listener defaulted to :80, which the image's non-root user cannot bind on runtimes that keep the kernel's privileged-port floor, such as OpenShift and Podman. The proxy logged the failure and kept running without it, so http-01 issuance could never succeed. Default it to :8081, mirroring how the main listener already moves to :8443. --- proxy/Dockerfile.ubi | 3 +++ 1 file changed, 3 insertions(+) diff --git a/proxy/Dockerfile.ubi b/proxy/Dockerfile.ubi index 7ebbc70e8..a74280a49 100644 --- a/proxy/Dockerfile.ubi +++ b/proxy/Dockerfile.ubi @@ -24,6 +24,9 @@ RUN mkdir -p /var/lib/netbird /certs && \ USER 1000:0 ENV HOME=/var/lib/netbird ENV NB_PROXY_ADDRESS=":8443" +# Unprivileged ports: runtimes such as OpenShift and Podman keep the kernel +# default that reserves ports below 1024 for root. 8080 is the health probe. +ENV NB_PROXY_ACME_ADDRESS=":8081" EXPOSE 8443 STOPSIGNAL SIGTERM ENTRYPOINT ["/go/bin/netbird-proxy"]