Hey all, Just wanted to report what is either a documentation issur, or an issue in `passt` proper. The `man` pages document the following for binding to low numbered (i.e. service ports): or the CAP_NET_BIND_SERVICE Linux capability is granted, see services(5) and capabilities(7). [...] To grant this capability, you can issue, as root: for p in $(which passt passt.avx2); do setcap 'cap_net_bind_service=+ep' "${p}" done However, this does not work: # setcap 'cap_net_bind_service=+ep' /usr/local/bin/passt # setcap 'cap_net_bind_service=+ep' /usr/local/bin/passt.avx2 $ /usr/local/bin/passt -f -t 123 Listen failed for HOST TCP port */123: Permission denied Couldn't listen on requsted ports [1] The reason I'm asking is that `krun` uses `passt` for port forwarding and is having issues with service ports [1]. The current work-around is to set the `net.ipv4.ip_unprivileged_port_start` sysctl to a lower number in the container where `passt` is run, but since `passt` is started already with `CAP_NET_BIND_SERVICE` it would be nice for that to work and not require the `sysctl` work-around. Anyway, curious to know if this is documentation issue or actually something that should be working but isn't (or a local setup issue). Regards, Nick [1]: https://github.com/containers/crun/issues/2251