Setting for local_port_range overlaps with very common listen ports

[fasaxc]

Image I'm using:

Bottlerocket appears to set the local port range to

net.ipv4.ip_local_port_range = 1025 65000

In this file:
/~https://github.com/bottlerocket-os/bottlerocket/blob/v1.0.5/packages/release/release-sysctl.conf#L23

What I expected to happen:

Ports in the 8000-10000 range should be available for services to listen on (e.g. HTTP servers on 8081, common healthcheck ports etc).

What actually happened:

Outbound sockets can claim those ports resulting in sporadic failures to bind. I work on a project that opens port 9090; one of our users reported sporadic failures on bottlerocket because port 9090 gets used at random for outbound connections.

How to reproduce the problem:

Make lots of outbound connections, try to bind to say port 8080; it may fail at random if an outbound connection happened to use that port.

[arnaldo2792]

Hello @fasaxc , thanks for the issue!

As you mentioned, Bottlerocket uses a wide port range for net.ipv4.ip_local_port_range, the reason being that applications and services running in the host could create many outbound connections.

You can override this value through the API as a workaround for now, either using user data or API calls from the control/admin containers:

# With user data
#...
[settings.kernel.sysctl]
"net.ipv4.ip_local_port_range" = "<range>"

# With API calls
apiclient set --json '{"kernel": {"sysctl": {"net.ipv4.ip_local_port_range": "<range>"}}}'

We will evaluate reducing the range for the next release. This raises some compatibility concerns since users may be relying on the existing value, but there are compatibility concerns with the current default as well.

[fasaxc]

Thanks, I'll let the user who raised it know how to configure that.

Clearly, there's a trade-off here but we certainly found it surprising that there were no guaranteed-available server ports > 1024.

[bcressey]

Current thinking is that we'll align this with the ECS values in the variants for Kubernetes 1.20 onward.