Failed to start HTTP listener inside the container

[graphixillusion]

Heya there: with the latest version (1.63.2) im getting this error:

01:13:15 web.1 | {"time":"2025-11-17T01:13:15.526689038Z","level":"ERROR","msg":"Failed to start HTTP listener","error":"listen tcp :80: bind: permission denied"}

Latest stable version (1.62.1) doesn't have this problem

[github-actions]

Hello @graphixillusion, thanks for contributing to the Password Pusher community! We will respond as soon as possible.

[m3nu]

Seeing the same at pikapod.com. It tries to use port 80 and fails. Before our port was 5100.

[pglombardo]

Ok thanks for the reports! I'll look at this today.

[wrbbz]

Same here. The issue persists from 1.63.0
I've tried to run the command from the documentation and got permission denied error:

docker run -d -p "80:80" -p "443:443" pglombardo/pwpush:1.63.1

[pglombardo]

I believe I have found the issue. To confirm, could you tell me these two things?

Which database are you using?

Can you post the output showing which docker volumes you have?
docker inspect <container-id> --format '{{range .Mounts}}{{.Destination}}{{println}}{{end}}'

@wrbbz - understood that you are using the ephemeral based on the link you posted.

[wrbbz]

I've tried on sqlite my local machine without additioanl volumes, and standalone Postgres also without additional volumes

[pglombardo]

At least a couple issues fixed. latest and v1.63.3 tags updated. Could you refetch and try again?

[didiermfb]

Same for me with the v1.63.3 :/

According to DATABASE_URL database backend is set to sqlite3:...

Password Pusher: migrating database to latest...
Password Pusher Version: 1.63.3
Password Pusher: starting foreman...
13:10:15 web.1    | started with pid 11
13:10:15 worker.1 | started with pid 12
13:10:16 web.1    | {"time":"2025-11-17T13:10:16.320283692Z","level":"ERROR","msg":"Failed to start HTTP listener","error":"listen tcp :80: bind: permission denied"}

Output of the inspect:

/opt/PasswordPusher/database
/opt/PasswordPusher/public/logos

And the environment part for the database:
DATABASE_URL=sqlite3:///opt/PasswordPusher/database/db.sqlite3

This is working properly with 1.62.1

[graphixillusion]

Same for me with 1.63.3:

14:12:06 web.1 | {"time":"2025-11-17T14:12:06.002267852Z","level":"ERROR","msg":"Failed to start HTTP listener","error":"listen tcp :80: bind: permission denied"}

As db i'm using sqlite3 and for mounted volume i'm using a local folder:

./storage:/opt/PasswordPusher/storage

with a env like this:

DATABASE_URL: sqlite3:storage/db.sqlite3 (without this env, the container always starts in ephereal mode, even with the mount specified)

[pglombardo]

Just a summary of research so far:

Nothing has changed in port mapping & handling from v1.62.1--> v1.63.3 so I was at a loss of an explanation. Then I found that in v1.63.0, the thruster gem was updated. This is the internal web server and handles web requests & TLS certificate provisioning.

The most likely candidate so far is in their latest release, they fixed a bug to "Log error and exit if unable to bind ports" where previously it was a silent error.

This comment explains it best:

The workaround is to have Thruster use a higher port number by setting an environment variable. For HTTP that is HTTP_PORT=8080, and for TLS that is HTTPS_PORT=8443 or whatever you like.

In my local Docker host these work (because I'm not on AWS or another cloud that limits <1024 ports):

docker run -p "80:80" -p "443:443" pglombardo/pwpush:latest
docker run -p "5100:5100" pglombardo/pwpush:latest

If the thruster bug is the real cause, booting the container with HTTP_PORT & HTTPS_PORT values above 1024 would reveal this.

docker run -p "5100:5100" -e HTTP_PORT=8080 -e HTTPS_PORT=8443 pglombardo/pwpush:latest

The Password Pusher Dockerfile exposes 80, 443 & 5100. All three work - it just depends on what you expose when you launch the container.

So for you all:

1. Are you all running on a cloud provider that may limit ports <1024?
2. Can you add -e HTTP_PORT=8080 -e HTTPS_PORT=8443 to your environment variables to test? This may resolve the error and port 5100 will still be available.
3. If ports 8080 and 8443 are needed, I can add them to the Dockerfile to use this work around.

Apologies on length - complex issue.

[pglombardo]

@m3nu - I launched a container on PikaPods to try to reproduce. I saw the memory limit. FYI The background worker is optional. If you add the env var PWP__NO_WORKER=true, it won't launch the worker and save 200MB(guestimate) of RAM.

Without a worker, pushes are lazily expired - on next access, expiration is revalidated before showing. Expiration jobs can be manually run from Admin dashboard as needed. Just a possible improvement for PikaPods if it helps.

[didiermfb]

I'm using my own server but ports < 1024 are limitied yes.
Adding the HTTP_PORT and HTTPS_PORT > 1024 works (those port are not exposed on my side. Only the 5100 and reverse proxying)

[pglombardo]

Adding the HTTP_PORT and HTTPS_PORT > 1024 works (those port are not exposed on my side. Only the 5100 and reverse proxying)

That's good news. I might have to change the default internal ports to 8080 and 8443 - or the alternative is to set these env vars. Still undecided.

[graphixillusion]

I'm using my own server but ports < 1024 are limitied yes. Adding the HTTP_PORT and HTTPS_PORT > 1024 works (those port are not exposed on my side. Only the 5100 and reverse proxying)

Same things for me: in my compose file i have exposed just the port 5100 as i don't need to expose the 80/443 ports because i'm using nginx proxy manager as reverse proxy with ssl certificate management

That's good news. I might have to change the default internal ports to 8080 and 8443 - or the alternative is to set these env vars. Still undecided.

I think an env var with something like HTTP/S_PORT= 8080/443/false to customize both ports numbers and enable/disable the feature when not needed would be great!