Running Keycloak on Linux as non-root, binding to privileged port #42579

martin-sony · 2025-09-12T09:01:18Z

martin-sony
Sep 12, 2025

Hi,

I want to run Keycloak as a systemd service on Linux, where the user is not root (user=keycloak, group=keycloak) but still bind to privileged port 443. The only way I have managed to achieve this so far is by giving CAP_NET_BIND_SERVICE capability to the JVM itself:
setcap CAP_NET_BIND_SERVICE=+eip /usr/lib/jvm/java-21-openjdk-amd64/bin/java
but is not ideal.

The best solution IMO would be to add this to the systemd service config file itself:

User=keycloak
Group=keycloak
LimitNOFILE=102642
PIDFile=/run/keycloak/keycloak.pid
ExecStart=/opt/keycloak/bin/kc.sh start --optimized
StandardOutput=null
AmbientCapabilities=CAP_NET_BIND_SERVICE

but this does not work, since kc.sh is a script and capabilities are ignored when executing scripts.

Is there a best practice here? How have others solved this?

Navigation Menu

Repository navigation

Running Keycloak on Linux as non-root, binding to privileged port #42579

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Running Keycloak on Linux as non-root, binding to privileged port #42579

Uh oh!

martin-sony Sep 12, 2025

Replies: 0 comments

martin-sony
Sep 12, 2025