自定义Debian系统IoT Edge网关Kestrel启动失败问题咨询

Hey there, let's break down why you're hitting this frustrating error on your custom Debian IoT Edge setup, and how to fix it.

First, the critical line from your logs that points us straight to the issue:

2018-05-06 23:55:00.759 +00:00 [FTL] - Unable to start Kestrel. Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv.Internal.Networking.UvException: Error -13 EACCES permission denied

Common Causes #

• Low Port Binding Permission: The most likely culprit is that Edge Hub's Kestrel server is trying to bind to a port below 1024 (like default HTTP port 80 or HTTPS port 443). On Linux, only the root user has permission to use ports in this range, and IoT Edge processes run as a non-root user by default for security.
• Security Module Restrictions: Your custom Debian distro might have SELinux or AppArmor enabled. These security frameworks can block network port binding even for ports above 1024 if the proper permissions aren't granted to the Edge Hub process.
• Temporary Port Conflict: While less likely with an EACCES error, intermittent issues could happen if another process temporarily grabs the port you're trying to use.

Fixes to Try #

• Switch to a High Port (1024+): Update your IoT Edge deployment manifest to configure Edge Hub's HTTP protocol head to use a port above 1024 (like 8080). In the $edgeHub module's properties.desired section, adjust the portBindings or httpSettings to use the higher port. This avoids needing root-level permissions entirely.
• Grant Port Binding Permissions: If you need to use a low port, give the Edge Hub binary the ability to bind to ports below 1024 using setcap. Locate the Edge Hub executable (usually at /app/edgehub in the container) and run:

  sudo setcap 'cap_net_bind_service=+ep' /path/to/edgehub
  

  Note: This elevates the process's permissions, so weigh the security tradeoff for your environment.
• Adjust Security Module Rules: If SELinux or AppArmor is blocking the process:
  • For AppArmor: Modify Edge Hub's AppArmor profile to include permissions for network port binding.
  • For SELinux: Use setsebool to enable appropriate network access, or create a custom policy to allow Edge Hub to bind ports.
• Check for Port Conflicts: When the error occurs, run this command to see if another process is using the target port:

  ss -tulpn | grep <your-port-number>
  

  If you find a conflicting process, stop it or adjust Edge Hub to use a different port.

内容的提问来源于stack exchange，提问作者Fai Lai