From 5451dd87e54bda6f1cb911b23a6b9f8b9b2c11e3 Mon Sep 17 00:00:00 2001
From: WrBug <iwrbug@gmail.com>
Date: Wed, 3 Dec 2025 05:25:14 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=20Nginx=20=E7=BB=91?=
 =?UTF-8?q?=E5=AE=9A=2080=20=E7=AB=AF=E5=8F=A3=E7=9A=84=E6=9D=83=E9=99=90?=
 =?UTF-8?q?=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 使用 setcap 允许非 root 用户绑定特权端口
  - 安装 libcap2-bin 包
  - 设置 cap_net_bind_service 权限给 nginx 二进制文件
- 修复 Nginx PID 文件路径
  - 从 /tmp/nginx.pid 改为 /var/run/nginx.pid
  - 创建 /var/run 目录并设置权限
- 解决 'bind() to 0.0.0.0:80 failed (13: Permission denied)' 错误
---
 Dockerfile        | 11 +++++++----
 docker/nginx.conf |  2 +-
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index a1eae24..a14e44d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -38,9 +38,11 @@ WORKDIR /app
 
 # 安装 Nginx 和必要的工具
 RUN apt-get update && \
-    apt-get install -y nginx curl && \
+    apt-get install -y nginx curl libcap2-bin && \
     rm -rf /var/lib/apt/lists/* && \
-    rm -rf /etc/nginx/sites-enabled/default
+    rm -rf /etc/nginx/sites-enabled/default && \
+    # 给 Nginx 二进制文件设置权限，允许非 root 用户绑定 80 端口
+    setcap 'cap_net_bind_service=+ep' /usr/sbin/nginx || true
 
 # 从构建阶段复制文件
 COPY --from=frontend-build /app/frontend/dist /usr/share/nginx/html
@@ -57,13 +59,14 @@ RUN chmod +x /app/start.sh
 RUN useradd -m -u 1000 appuser
 
 # 创建 Nginx 运行目录并设置权限
-RUN mkdir -p /var/log/nginx /var/lib/nginx /var/cache/nginx && \
+RUN mkdir -p /var/log/nginx /var/lib/nginx /var/cache/nginx /var/run && \
     chown -R appuser:appuser /app && \
     chown -R appuser:appuser /usr/share/nginx/html && \
     chown -R appuser:appuser /var/log/nginx && \
     chown -R appuser:appuser /var/lib/nginx && \
     chown -R appuser:appuser /var/cache/nginx && \
-    chown -R appuser:appuser /etc/nginx
+    chown -R appuser:appuser /etc/nginx && \
+    chown -R appuser:appuser /var/run
 
 USER appuser
 
diff --git a/docker/nginx.conf b/docker/nginx.conf
index 1347fe0..e4265eb 100644
--- a/docker/nginx.conf
+++ b/docker/nginx.conf
@@ -1,7 +1,7 @@
 user appuser;
 worker_processes auto;
 error_log /var/log/nginx/error.log warn;
-pid /tmp/nginx.pid;
+pid /var/run/nginx.pid;
 
 events {
     worker_connections 1024;