A privileged port is a network port below 1024, such as HTTP port 80, that traditionally requires elevated operating-system privileges to bind. Running a container as a non-root user improves defense in depth, but an application listening on port 80 can then fail with a permission error. section 12.4
The practical workaround is to separate the application’s listening port from its external port. Configure the server to listen on an unprivileged port such as 8080, then configure a Kubernetes Service to expose port 80 and target port 8080.
Moving a non-root server off port 80
A Deployment enforcing runAsNonRoot can fail when its image still starts a server on port 80. Change the server to 8080 and set the Service’s targetPort to 8080; clients can continue using port 80.
