Repository navigation
Unable to bind ports: Docker-for-Windows & Hyper-V excluding but not using important port ranges #783
Description
- I have tried with the latest version of my channel (Stable or Edge)
- I have uploaded Diagnostics
- Diagnostics ID:
BB0297BB-C287-4F0B-A007-72B5F2D7BD72/20190102235413
Expected behavior
Be able to bind specific ports that I have always used.
Be able to specify which ports docker/hyperv exclude or use, and/or I expect that docker/hyper-v actually use the ports that it is excluding and that they show up in netstat -ano as being used or listened on.
Actual behavior
If I start a service that binds on port 50051 (it is a grpc service, and that is the traditional port used by grpc), it says:
listen tcp :50051: bind: An attempt was made to access a socket in a way forbidden by its access permissions.
Information
- Is it reproducible? Yes
- Is the problem new? Yes. My previous installation of docker for windows, from a year ago when I was on Windows 1709, didn't have this problem.
- Did the problem appear with an update? Yes, you could say that. I wiped my harddrive and started over with Windows 1809 and the latest version of Docker for Windows.
- Windows Version: Windows 10 Pro 1809 (Version 10.0.17763 Build 17763)
- Docker for Windows Version: 2.0.0.0-win81
- Docker version: 18.09.0
Steps to reproduce the behavior
MinGW 12:11:50 ~$ docker run -p 50051:50051 hello-world
C:\Program Files\Docker\Docker\Resources\bin\docker.exe: Error response from daemon: driver failed programming external connectivity on endpoint infallible_lehmann (906354afc8855cc38fc8ac3e9e5b0642c9470f48f99c48e188ed3c8cfe236c9e): Error starting userland proxy: Bind for 0.0.0.0:50051: unexpected error Permission denied.
My own investigation:
I was extremely confused by this problem, because I was able to bind other ports, such as 8080 or 60000, yet it did not appear that 50051 was in use by anything on my system.
Running netstat -ano shows nothing using 50051.
Running Get-NetTCPConnection in powershell with admin privileges shows nothing using 50051.
Even if I disconnect from the internet and disable both windows firewall and my antivirus, and run everything as admin, I still get the errors.
After hours of google searching, I found a command that showed what happened to 50051:
PS C:\WINDOWS\system32> netsh interface ipv4 show excludedportrange protocol=tcp
Protocol tcp Port Exclusion Ranges
Start Port End Port
---------- --------
49692 49791
49792 49891
49892 49991
49992 50091
50092 50191
50214 50313
50498 50597
* - Administered port exclusions.
It seems that 50051 is excluded (whatever that means?!), even though it isn't in use by anything.
After lots of trial and error, I discovered that Docker for Windows and Hyper-V are responsible for all of those excluded port ranges above.
It also seems like all those port ranges change or increase by 1 every time I reboot, so I suppose 450 reboots from now my problem will go away, maybe...
I have never had this problem, despite using docker for years now.
I run lots of containers and setups that other people at my company work on and rely on, so it is not feasible for me to be changing the ports around on them to work around this issue. (Other people use the kube templates and docker-compose, and some of them connect with other docker-compose networks, etc, and expect things on certain ports.)
When I try to delete that excluded port range, I get this, despite running the command as administrator:
PS C:\WINDOWS\system32> netsh interface ipv4 delete excludedportrange protocol=tcp startport=49992 numberofports=100
Access is denied.
Activity
rramsden commentedon Jan 23, 2019
Solution in googlevr/gvr-unity-sdk#1002 works for me but not ideal
veqryn commentedon Jan 23, 2019
That workaround does not work for me, unfortunately, despite having admin rights.
enashed commentedon Jan 31, 2019
@veqryn the workaround worked for me, the steps are:
Disable hyper-v (which will required a couple of restarts)
dism.exe /Online /Disable-Feature:Microsoft-Hyper-VWhen you finish all the required restarts, reserve the port you want so hyper-v doesn't reserve it back
netsh int ipv4 add excludedportrange protocol=tcp startport=50051 numberofports=1Re-Enable hyper-V (which will require a couple of restart)
dism.exe /Online /Enable-Feature:Microsoft-Hyper-V /Allwhen your system is back, you will be able to bind to that port successfully.
Make Electrum tests pass on windows (#932)
docker-robott commentedon May 1, 2019
Issues go stale after 90d of inactivity.
Mark the issue as fresh with
/remove-lifecycle stalecomment.Stale issues will be closed after an additional 30d of inactivity.
Prevent issues from auto-closing with an
/lifecycle frozencomment.If this issue is safe to close now please do so.
Send feedback to Docker Community Slack channels #docker-for-mac or #docker-for-windows.
/lifecycle stale
veqryn commentedon May 1, 2019
/remove-lifecycle stale
Merge master into Android (#1002)
dozer75 commentedon Jun 12, 2019
What's the status for this?
Today I had 100 of reservations which caused Skype for Business to stop working since it couldn't find any available ports. Uninstall docker/hyper-v/containers removed these reservations and Skype for Business had ports to work with again.
This is a critical error that should be focused on since it reserves so many ports that isn't in use. I can't uninstall docker/hyper-v/containers or similar workarounds each time I get problems with Skype for Business in conjunction with meetings.
Sureiya commentedon Jun 26, 2019
This makes hyper-v unusable for me and most of my company.
sbley commentedon Jul 16, 2019
@enashed Does your solution (disabling and re-enabling HyperV) have any side effects? Will my virtual switches and virtual machines still be there after applying your solution?
sbley commentedon Aug 1, 2019
Answering myself: This actually does have side effects. It deletes your virtual switches. You should keep that in mind when applying this solution.
ciprian-chichirita commentedon Sep 6, 2019
this issue is still present
/remove-lifecycle stale
danidemi commentedon Sep 17, 2019
Hi guys, I've the same problem. This is really blocking me.
94 remaining items
CyntaxDotDev commentedon May 31, 2023
Weird, it worked for me? I havent had the problem since but I'll try and verify when it pops up again.
geertschuring commentedon Jul 3, 2023
How is this still not solved.... very frustrating problem.
ducpham01 commentedon Jul 5, 2023
I'm having the same issue. But sometimes it says "The service is starting or stopping. Please try again later" after I run "net stop winnat", then I can't make it start again, and I get stuck there. :(
pplmx commentedon Jul 31, 2023
Still encouner this bug from time to time,
but following this can fix it:
CelestialArcadia commentedon Jan 17, 2024
SOLUTION: The right solution TLDR version
Source Article
The correct solution is simply to reset the “TCP Dynamic Port Range” so that Hyper-V only reserves ports in the range we have set. You can reset the “TCP Dynamic Port Range” to 49152–65535 by running the following command with administrator privileges, but you can also change it to a smaller range if you think it is too large.
The article discusses a problem encountered while using Docker. The issue involves ports of Docker containers not working, leading to a common error related to access permissions. The root cause is attributed to the "TCP dynamic port range" in Windows, with potential conflicts arising from Hyper-V's reserved port numbers.
The article acknowledges that while stopping and starting the Winnat service may offer a temporary solution, it explicitly states that this method is essentially a simplified version of rebooting the computer. The author points out that relying on this approach may not guarantee a resolution, as the probability of success is random, with some users reporting it works while others say it doesn't. The article strongly recommends against this method as a reliable or optimal solution due to its unpredictable nature.
Add retry to getAvailablePort to avoid spordic CI failure on windows …
Fix bind failure on Windows in DNS tests
tests: Fix bind failure on Windows in DNS tests
fix(install,doctor): Windows HNS port-22 reservation (continuum's dia…
Add retry to getAvailablePort to avoid spordic CI failure on windows (o…
Add retry to getAvailablePort to avoid spordic CI failure on windows …
neversamiever-art commentedon Oct 7, 2026
Docker says the port is taken, but no program is listening. Windows often reserved that port for itself.
Check:
netsh interface ipv4 show excludedportrange protocol=tcpIf your port is on that list, the WinNAT service is holding it. Give it back:
net stop winnatnet start winnatIf your port is not on that list, this will not help. Something else really has the port.