[BUG] image produced lacks capabilities flag on syslog-ng binary

[rmackinnon]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

With a default installation ports below 1024 receive a permissions denied error

2025-10-26 08:01:55.641557113  [2025-10-26T08:01:55.641490] Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Permission denied (13)'
2025-10-26 08:01:55.641563052  [2025-10-26T08:01:55.641490] Error initializing message pipeline; plugin_name='syslog', location='/config/sources.conf:6:3'

Expected Behavior

Ports defined should be bound to, and not receive a permissions error.

Steps To Reproduce

1. install image via docker by listed command below:
2. define the following source:

source s_514tcp {
  syslog(transport(tcp) port(514));
};

3. receive error, and the server fails to start.

Environment

- OS: Gentoo Linux
- How docker service was installed: Portage

CPU architecture

x86-64

Docker creation

docker run \
   -it \
   --name somehostname \
   --network host \
   --tmpfs /tmp \
   -p 514:514 -p 514:514/udp -p 5514:5514/udp -p 6601:6601 -p 6514:6514 \
   -v /local-configs:/config:z \
   linuxserver/syslog-ng:latest

Container logs

───────────────────────────────────────

      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝

   Brought to you by linuxserver.io
───────────────────────────────────────

To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    911
User GID:    911
───────────────────────────────────────
Linuxserver.io version: 4.8.3-r1-ls173
Build-date: 2025-10-23T19:01:10+00:00
───────────────────────────────────────
    
[custom-init] No custom files found, skipping...
crond[167]: crond (busybox 1.37.0) started, log level 5
crond[167]: user:root entry:*/15	*	*	*	*	run-parts /etc/periodic/15min
crond[167]: user:root entry:0	*	*	*	*	run-parts /etc/periodic/hourly
crond[167]: user:root entry:0	2	*	*	*	run-parts /etc/periodic/daily
crond[167]: user:root entry:0	3	*	*	6	run-parts /etc/periodic/weekly
crond[167]: user:root entry:0	5	1	*	*	run-parts /etc/periodic/monthly
[ls.io-init] done.
[migrations] started
[migrations] no migrations found
usermod: no changes
crond[171]: wakeup dt=10
crond[171]: file root:
crond[171]:  line run-parts /etc/periodic/15min
crond[171]:  line run-parts /etc/periodic/hourly
crond[171]:  line run-parts /etc/periodic/daily
crond[171]:  line run-parts /etc/periodic/weekly
crond[171]:  line run-parts /etc/periodic/monthly
crond[171]: wakeup dt=60
crond[171]: file root:
crond[171]:  line run-parts /etc/periodic/15min
crond[171]:  line run-parts /etc/periodic/hourly
crond[171]:  line run-parts /etc/periodic/daily
crond[171]:  line run-parts /etc/periodic/weekly
crond[171]:  line run-parts /etc/periodic/monthly
...

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[rmackinnon]

The core issue here is that the linux capabilities flag for the binary are not set at installation/build to allow the UID 911 to run at ports below 1024. Therefore the solution is pretty straight forward with an update to the Dockerfile to build the image with the following after building/installing syslog-ng:

+RUN apk add libcap-setcap
+RUN setcap 'cap_net_bind_service+ep' /usr/sbin/syslog-ng

The work-around until then is to apply the following to the container manually:

docker exec -u root -t <yourhostnamehere> apk add libcap-setcap
docker exec -u root -t <yourhostnamehere> setcap 'cap_net_bind_service+ep' /usr/sbin/syslog-ng

By setting only this effective and permissive capability, the daemon is allowed by the kernel to open ports lower than 1024 without having to run as root.

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.

[rmackinnon]

There has been no response to this issue from a contributor.

[thespad]

You're running this in host networking mode, so the port mappings have no effect.

The reason the shipped config is configured the way it is with the ports it uses is to avoid issues with privileged ports inside the container; Docker itself (as long as you're running a supported version) will allow you to map bridged ports below 1024 as an unprivileged user but in host networking mode you're leveraging the host networking stack so Docker doesn't get involved in the process.

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.