MikroTik Container port 53 bind permission denied

[xaizone]

Hey,

trying to run Blocky under MikroTik Containers and I keep getting:

ERROR server start failed: start tcp listener failed: listen tcp :53: bind: permission denied.

Any idea how I could solve this? Maybe somebody has run into the same issue already and was able to solve it. Sorry if this is not the right place to ask.

MikroTik config:

/interface bridge add name=container
/interface veth add address=172.17.0.2/24 gateway=172.17.0.1 name=veth1
/ip address add address=172.17.0.1/24 interface=container network=172.17.0.0
/ip firewall nat add action=masquerade chain=srcnat src-address=172.17.0.0/24
/container config set registry-url=https://registry-1.docker.io tmpdir=docker/temp

(I excluded unrelated stuff)

/container/print output:

/container/print
 0 name="9dc99852-9ff8-4c6f-9402-aee4836dd86b" tag="spx01/blocky:latest" os="linux" 
   arch="arm64" interface=veth1 root-dir=docker/storage/blocky mounts="" dns="" 
   workdir="/app" logging=yes start-on-boot=yes status=stopped

Blocky config:

upstream:
  default:
    - 1.1.1.1
    - 1.0.0.1

blocking:
  blackLists:
    ads:
      - https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
  clientGroupsBlock:
    default:
      - ads

port: 53

[ThinkChaos]

Ports <= 1024 are privileged and can only be used by root (or with a specific capability).
I've never used MikroTik containers, but I think the best would be to listen on a port >1024 in the container, and setup destination NAT from port 53 to that other port.

[xaizone]

Good idea, thanks.

It works, but the setup is kind of clunky... I will try to come up with a different solution. My first idea was to build my own image and use root inside it. This would work as expected, but that's a security risk and a half.

Maybe giving users the ability to change the user with ENV could be a nice feature. Something like Linuxserver do with their images.

[xaizone]

Here's a write up on how to set this up for future references.

https://xaizone.eu/post/setup-blocky-on-mikrotik-routeros/