Running with podman fails when launching novnc process

[KarmaAlex]

Trying to run the container as instructed with podman run -it -p 6080:80 --name ros2_test_bad --security-opt seccomp=unconfined --shm-size=512m docker.io/tiryoh/ros2-desktop-vnc:jazzy
fails to spawn the novnc process, and so the web interface does not work. Log:

* enable custom user: ubuntu
useradd: user 'ubuntu' already exists
  set default password to "ubuntu"
============================================================================================
Launched docker container.
Open http://127.0.0.1:6080 via web browser.

NOTE 1: Default user is "ubuntu", password is "ubuntu".
NOTE 2: --security-opt seccomp=unconfined flag is required to launch Ubuntu Jammy/Noble based image on some environment.
See https://github.com/Tiryoh/docker-ros2-desktop-vnc/pull/56
============================================================================================
2025-11-18 14:50:43,239 INFO Included extra file "/etc/supervisor/conf.d/supervisord.conf" during parsing
2025-11-18 14:50:43,239 INFO Set uid to user 0 succeeded
2025-11-18 14:50:43,242 INFO RPC interface 'supervisor' initialized
2025-11-18 14:50:43,242 CRIT Server 'unix_http_server' running without any HTTP authentication checking
2025-11-18 14:50:43,242 INFO supervisord started with pid 32
2025-11-18 14:50:44,246 INFO spawned: 'novnc' with pid 33
2025-11-18 14:50:44,247 INFO spawned: 'vnc' with pid 34
2025-11-18 14:50:44,415 WARN exited: novnc (exit status 1; not expected)
2025-11-18 14:50:45,426 INFO spawned: 'novnc' with pid 654
2025-11-18 14:50:45,426 INFO success: vnc entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2025-11-18 14:50:45,568 WARN exited: novnc (exit status 1; not expected)
2025-11-18 14:50:47,571 INFO spawned: 'novnc' with pid 709
2025-11-18 14:50:47,739 WARN exited: novnc (exit status 1; not expected)
2025-11-18 14:50:50,743 INFO spawned: 'novnc' with pid 741
2025-11-18 14:50:50,899 WARN exited: novnc (exit status 1; not expected)
2025-11-18 14:50:51,900 INFO gave up: novnc entered FATAL state, too many start retries too quickly

Digging into it this is caused by a permissions issue, as running the command gosu 'ubuntu' bash -c "websockify --web=/usr/lib/novnc 80 localhost:5901" returns

root@fd8d33181909:/# gosu 'ubuntu' bash -c "websockify --web=/usr/lib/novnc 80 localhost:5901"
WebSocket server settings:
  - Listen on :80
  - Web server. Web root: /usr/lib/novnc
  - No SSL/TLS support (no cert file)
Traceback (most recent call last):
  File "/usr/local/bin/websockify", line 8, in <module>
    sys.exit(websockify_init())
             ^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/websockify/websocketproxy.py", line 696, in websockify_init
    server.start_server()
  File "/usr/local/lib/python3.12/dist-packages/websockify/websockifyserver.py", line 704, in start_server
    lsock = self.socket(self.listen_host, self.listen_port, False,
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/websockify/websockifyserver.py", line 470, in socket
    sock.bind(addrs[0][4])
PermissionError: [Errno 13] Permission denied

because it's trying to bind to port 80 as a non-sudo user. I personally fixed this by replacing the command in the bash script with sudo bash -c etc...
I can understand if it's not ideal however so any other solution is welcome.

[Tiryoh]

Hi @KarmaAlex,

Thanks for the detailed report and logs — they were very helpful.

Short summary / likely cause

• The traceback you included (PermissionError: [Errno 13] Permission denied on binding port 80) indicates that websockify failed to bind to a privileged port (80) because it was running without sufficient permissions.
• In this image, the entrypoint generates a supervisord config that launches noVNC/websockify using gosu "$USER", which intentionally drops privileges to a non-root user.
• Under Podman — especially in rootless mode — the container may run as a non-root user by default, so websockify ends up running without permission to bind to port 80. This matches the failure you observed.

Quick workaround

You can force the container to run as root so that the entrypoint does not drop privileges:

podman run -it -p 6080:80 -e USER=root \
  --name ros2_test docker.io/tiryoh/ros2-desktop-vnc:jazzy

(The same -e USER=root workaround works with docker run as well.)
This should allow websockify to bind to port 80. I have not tested this exact command in your environment, so please treat it as an unverified workaround.

---

Longer-term considerations (for future maintenance work)

These are notes for potential future improvements on my side, not required actions for users.

1) Run only noVNC/websockify as root (supervisord change)

• Adjust the generated supervisord config so that only the [program:novnc] entry runs without gosu "$USER".
• Pros: simple and reliable.
• Cons: the web UI process runs as root.

2) Switch to a non-privileged port

• Change the default noVNC/websockify port to something above 1024 (e.g., 6080 or 8080) and update documentation accordingly.
• Pros: safest option; avoids privileged bind entirely.
• Cons: changes the existing user-facing interface.

3) Grant the Python binary capability to bind privileged ports

• Apply

  setcap 'cap_net_bind_service=+ep' /usr/bin/python3

  during the image build.

• Pros: allows binding port 80 without running as root.

• Cons: capabilities may be lost when Python is updated; must ensure the correct interpreter is patched; depends on filesystem/kernel support.

4) Add capability at runtime

• Run the container with:

  --cap-add=NET_BIND_SERVICE

• Pros: does not require rebuilding the image.

• Cons: may not work under rootless Podman; capability handling differs from rootful Docker.

Note: longer-term ideas 3 and 4 were suggested with assistance from GPT-5.1.

---

Notes regarding Podman / rootless behavior

Rootless Podman restricts privileged operations and handles user permissions differently from rootful Docker. This makes binding privileged ports more likely to fail in rootless environments, which aligns with the behavior seen in this issue.