루트 없는 포트 80/443 사용하기 방법: 방화벽으로
(이 글은 영어로 또 있어요.)
유닉스는 루트만 1024이한 포트를 사용할 수 있어요. 근데 인터넷 듣기 위험해요: 이 프러그램이 보안 취약 있으면 나쁜 넘들이 루트 권한을 받을 수 있어요. 그래서 비루트로 1024이한 포트를 사용한 방법 필요해요.
잘 아는 방법은:
`setuid`과 `setgid`로 포트 바인딩 하기 후에 일반 사용자 바꼬기 보텅 권한 해제해요.
자근 유틸리티
privbind는 모든 프로그램 1024이한 포트를 사용 권한으로 비루트로 시작해요.리눅스의
CAP_NET_BIND_SERVICE capability프로그램에게 권한을 해요.Docker아니면 다른 컨테이너는 포트과 사용자 옵션이 있어요.
Using Port 80/443 without root: Via the Firewall
In Unix/Linux only the root can use ports below 1024. However, listening to the internet is dangerous: If that program has a vulnerability, the bad guys can get root permissions. Therefore, you want to use a way to run the app without root and listen to the below 1024 ports.
There are well known methods:
Use
setuidandsetgidto change the user after binding to the ports.Using a small utility like ttps://github.com/JiriHorky/privbind[
privbind] to launch any program non-root but allow it to bind ports.In Linux, grant the
CAP_NET_BIND_SERVICE capabilityto a program.Use
Dockeror other container systems to bind the port and run under a different user.
OutOfMemoryError: Exit Immediately
TLDR: I highly recommend to use -XX:+ExitOnOutOfMemoryError or -XX:+CrashOnOutOfMemoryError
for Java apps, combined with -XX:HeapDumpPath=path-to-crash-dumps -XX:+HeapDumpOnOutOfMemoryError.
This stops the JVM from trying to limp on when it runs out of memory and provides dumps to analyze
the issue later.
Create Types on Demand and Cecilifier
This post is part of C# Advent Calendar 2025. Visit it for all the awesome upcoming posts!
The traditional C# Advent is here. Usually I give some daily and practical advice. Like testing tips [1] or some outsider view approach to C# [2] here. This time its more about fun with very niche applications.
Provide 'Just In Time' Types & Code?
In dotNet there are facilities to create types at Runtime. This exists of two things:
A callback that is called when a type isn’t found.
Loading and generating Assemblies at runtime.
Learned/Discovered this week: bpftrace, Windows in Docker, Testcontainers & Docker upgrade, Debugging-Tips
A short list of things I’ve learned or discovered this week.
bpftrace: DTrace for Linux
I discovered that bpftrace exists for Linux. It is similar to DTrace, where you instrument your system to debug it. That is great news (to me), because DTrace never made really to mainstream Linux. (Even Windows has it). bpftrace compiles things to eBPF programs to do the tracing, so it works on must Linux flavors.
Found via Brendan Gregg. Its one of the best resources for performance debugging.