Node.js 'Error: listen EACCES: permission denied 0.0.0.0:80' (or :443) when starting an Express/HTTP server. How do I bind a low port without running as root?

Cause: On Linux and most Unix systems, ports below 1024 are "privileged". Binding to one requires root or the CAP_NET_BIND_SERVICE capability. Your Node process runs as a normal user, so the kernel refuses the bind with EACCES. (If the error is EADDRINUSE instead, another process already holds the port, which is a different problem.) Fix (best first, none require running Node as root): 1. Listen on an unprivileged port such as 3000 or 8080 and put a reverse proxy (nginx, Caddy, a cloud load balancer, or your container platform's port mapping) in front on 80/443. This is the usual production design and also gives you TLS termination. In Docker, publish it with -p 80:3000 and keep the app on 3000. 2. Grant only the binding capability to the Node binary: sudo setcap 'cap_net_bind_service=+ep' "$(readlink -f "$(which node)")". It is a file capability, so it must be reapplied after Node is upgraded, and it applies to every script that binary runs, so prefer a dedicated Node copy for this service. Under systemd, a cleaner option is AmbientCapabilities=CAP_NET_BIND_SERVICE in the unit file for just that service. 3. Lower the system threshold with the net.ipv4.ip_unprivileged_port_start sysctl (default 1024). This is a broad, per-network-namespace change that lets any local user bind those ports, so use it only on single-purpose hosts or inside containers. 4. Avoid the shortcut of running the whole app with sudo or as root: it widens the damage of any bug in the app or its dependencies. Verify: start the service as the normal user and check ss -ltnp shows it listening on the intended port, with the process owner not being root. Sources: https://man7.org/linux/man-pages/man7/ip.7.html https://man7.org/linux/man-pages/man7/capabilities.7.html https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html