fix: improve error message when binding to privileged ports (fixes apple#978) (apple#1031)

- The container fails to start with a generic "permission denied"
  error when attempting to publish privileged ports (ports below
  1024) without root privileges. This provides a confusing user
  experience as the error doesn't explain why permission was
  denied.

Author: Ronitsabhaya75

Sources/Services/ContainerSandboxService/Server/SandboxService.swift

@@ -748,7 +748,17 @@ public actor SandboxService {
                                 log: self.log
  )
  }
- return try await forwarder.run().get()
+ do {
+ return try await forwarder.run().get()
+ } catch let error as IOError where error.errnoCode == EACCES {
+ if let port = proxyAddress.port, port < 1024 {
+ throw ContainerizationError(
+ .invalidArgument,
+                                    message: "Permission denied while binding to host port \(port). Binding to ports below 1024 requires root privileges."
+ )
+ }
+ throw error
+ }
  }
  }
  }

Tests/CLITests/Subcommands/Run/TestCLIRunCommand.swift

@@ -712,4 +712,29 @@ class TestCLIRunCommand: CLITest {
 
  return trimmedOutput
  }
+
+ @Test func testPrivilegedPortError() throws {
+ try #require(geteuid() != 0)
+
+ let name = getTestName()
+ let privilegedPort = 80
+ let (_, _, error, status) = try run(arguments: [
+ "run",
+ "--name", name,
+ "--publish", "127.0.0.1:\(privilegedPort):80",
+            alpine,
+ ])
+ defer {
+ try? doRemove(name: name, force: true)
+ }
+        #expect(status != 0, "Command should have failed")
+        #expect(
+            error.contains("Permission denied while binding to host port \(privilegedPort)"),
+ "Error message should mention permission denied for the port. Got: \(error)"
+ )
+        #expect(
+            error.contains("root privileges"),
+ "Error message should mention root privileges requirement. Got: \(error)"
+ )
+ }
 }