title: How to resolve "Permission denied" on .NET6 in EKS?
body: <p>I am new to AWS EKS but I am trying to deploy a sample WebApp using .NET6. However I get the following exception when I check the pod logs</p>
  <pre><code>    Microsoft.AspNetCore.DataProtection.Repositories.EphemeralXmlRepository[50]
        Using an in-memory repository. Keys will not be persisted to storage.
  warn: Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager[59]
        Neither user profile nor HKLM registry available. Using an ephemeral key repository. Protected data will be unavailable when application exits.
  dbug: Microsoft.Extensions.Hosting.Internal.Host[1]
        Hosting starting
  warn: Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager[35]
        No XML encryptor configured. Key {bc16347e-42d1-4598-adb3-06afbbb81c7a} may be persisted to storage in unencrypted form.
  warn: Microsoft.AspNetCore.Server.Kestrel[0]
        Overriding address(es) 'http://*:8080'. Binding to endpoints defined via IConfiguration and/or UseKestrel() instead.
  Unhandled exception. System.Net.Sockets.SocketException (13): Permission denied
     at System.Net.Sockets.Socket.UpdateStatusAfterSocketErrorAndThrowException(SocketError error, String callerName)
     at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot, SocketAddress socketAddress)
     at System.Net.Sockets.Socket.Bind(EndPoint localEP)
     at Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketTransportOptions.CreateDefaultBoundListenSocket(EndPoint endpoint)      
     at Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketConnectionListener.Bind()
     at Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketTransportFactory.BindAsync(EndPoint endpoint, CancellationToken cancellationToken)
     at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Infrastructure.TransportManager.BindAsync(EndPoint endPoint, ConnectionDelegate connectionDelegate, EndpointConfig endpointConfig, CancellationToken cancellationToken)
     at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerImpl.&lt;&gt;c__DisplayClass30_0`1.&lt;&lt;StartAsync&gt;g__OnBind|0&gt;d.MoveNext()
  --- End of stack trace from previous location ---
     at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindEndpointAsync(ListenOptions endpoint, AddressBindContext context, CancellationToken cancellationToken)
     at Microsoft.AspNetCore.Server.Kestrel.Core.ListenOptions.BindAsync(AddressBindContext context, CancellationToken cancellationToken)   
     at Microsoft.AspNetCore.Server.Kestrel.Core.AnyIPListenOptions.BindAsync(AddressBindContext context, CancellationToken cancellationToken)
     at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.EndpointsStrategy.BindAsync(AddressBindContext context, CancellationToken cancellationToken)
     at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindAsync(IEnumerable`1 listenOptions, AddressBindContext context, CancellationToken cancellationToken)
     at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerImpl.BindAsync(CancellationToken cancellationToken)
     at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerImpl.StartAsync[TContext](IHttpApplication`1 application, CancellationToken cancellationToken)
     at Microsoft.AspNetCore.Hosting.GenericWebHostService.StartAsync(CancellationToken cancellationToken)
     at Microsoft.Extensions.Hosting.Internal.Host.StartAsync(CancellationToken cancellationToken)
     at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost host, CancellationToken token)
     at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost host, CancellationToken token)
     at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.Run(IHost host)
     at Microsoft.AspNetCore.Builder.WebApplication.Run(String url)
     at Program.&lt;Main&gt;$(String[] args) in /src/SampleWebApp/Program.cs:line 24
  </code></pre>
  <p>It seems that the Kestrel cannot start but I don't know why. I have changed the Program.cs like this:</p>
  <pre class="lang-cs prettyprint-override"><code>var builder = WebApplication.CreateBuilder(args);
  builder.Services.AddRazorPages();
  builder.WebHost.UseKestrel(opts =&gt;
  {
      opts.ListenAnyIP(8080);
  });
  var app = builder.Build();
  </code></pre>
  <p>because I have read that ports below 1024 are not allowed in EKS. This did not do the trick. After that I have found the following article: <a href="https://techcommunity.microsoft.com/t5/azure-developer-community-blog/hardening-an-asp-net-container-running-on-kubernetes/ba-p/2542224" rel="nofollow noreferrer">https://techcommunity.microsoft.com/t5/azure-developer-community-blog/hardening-an-asp-net-container-running-on-kubernetes/ba-p/2542224</a> so I have applied all on my Dockerfile and helm chart. Unfortunately this did not fix the issue as well.</p>
  <p>Currently I have this as a Dockerfile:</p>
  <pre><code>FROM mcr.microsoft.com/dotnet/aspnet:6.0 AS base
  
  WORKDIR /app
  EXPOSE 8080
  
  ENV ASPNETCORE_URLS=http://*:8080
  ENV COMPlus_EnableDiagnostics=0
  
  RUN addgroup --group friendlygroupname --gid 2000 \
  &amp;&amp; adduser \    
      --uid 1000 \
      --gid 2000 \
      &quot;friendlyusername&quot; 
  
  RUN chown friendlyusername:friendlygroupname  /app /tmp
  USER friendlyusername:friendlygroupname 
  
  FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
  WORKDIR /src
  COPY [&quot;SampleWebApp/SampleWebApp.csproj&quot;, &quot;SampleWebApp/&quot;]
  RUN dotnet restore &quot;SampleWebApp/SampleWebApp.csproj&quot;
  COPY . .
  WORKDIR &quot;/src/SampleWebApp&quot;
  RUN dotnet build &quot;SampleWebApp.csproj&quot; -c Release -o /app/build
  
  FROM build AS publish
  RUN dotnet publish &quot;SampleWebApp.csproj&quot; -c Release -o /app/publish
  
  FROM base AS final
  WORKDIR /app
  COPY --from=publish /app/publish .
  
  ENTRYPOINT [&quot;dotnet&quot;, &quot;SampleWebApp.dll&quot;]
  </code></pre>
  <p>and my template for the helm chart of the deployment is:</p>
  <pre><code>apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: {{ include &quot;test-app.fullname&quot; . }}
    labels:
      {{- include &quot;test-app.labels&quot; . | nindent 4 }}
  spec:
    {{- if not .Values.autoscaling.enabled }}
    replicas: {{ .Values.replicaCount }}
    {{- end }}
    selector:
      matchLabels:
        {{- include &quot;test-app.selectorLabels&quot; . | nindent 6 }}
    template:
      metadata:
        {{- with .Values.podAnnotations }}
        annotations:
          {{- toYaml . | nindent 8 }}
        {{- end }}
        labels:
          {{- include &quot;test-app.selectorLabels&quot; . | nindent 8 }}
      spec:
        {{- with .Values.imagePullSecrets }}
        imagePullSecrets:
          {{- toYaml . | nindent 8 }}
        {{- end }}
        serviceAccountName: {{ include &quot;test-app.serviceAccountName&quot; . }}
        securityContext:
          {{- toYaml .Values.podSecurityContext | nindent 8 }}
        containers:
          - name: {{ .Chart.Name }}
            securityContext:
              {{- toYaml .Values.securityContext | nindent 12 }}
            image: &quot;{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}&quot;
            imagePullPolicy: {{ .Values.image.pullPolicy }}
            ports:
              - name: http
                containerPort: 8080
                protocol: TCP
            env:          
              {{- range .Values.env }}
              - name: {{ .name }}
                value: {{ .value | quote }}
              {{- end }}
            livenessProbe:
              httpGet:
                path: /
                port: http
            readinessProbe:
              httpGet:
                path: /
                port: http
            resources:
              {{- toYaml .Values.resources | nindent 12 }}
        {{- with .Values.nodeSelector }}
        nodeSelector:
          {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.affinity }}
        affinity:
          {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.tolerations }}
        tolerations:
          {{- toYaml . | nindent 8 }}
        {{- end }}
  </code></pre>
  <p>where I have the following values:</p>
  <pre><code>test-app:
      replicatCount: 1
  
      image:
          repository: 751825048932.dkr.ecr.eu-central-1.amazonaws.com/sample-web-app
          pullPolicy: IfNotPresent
          tag: &quot;latest&quot;
  
      env:
          - name: &quot;COMPlus_EnableDiagnostics&quot;
            value: &quot;0&quot;
          - name: &quot;ASPNETCORE_URLS&quot;
            value: &quot;http://*:8080&quot;
          - name: &quot;ASPNETCORE_ENVIRONMENT&quot;
            value: &quot;Development&quot;
          - name: &quot;Logging__LogLevel__Default&quot;
            value: &quot;Debug&quot;
  
      podSecurityContext: 
          runAsNonRoot: true
          runAsUser: 1000
          runAsGroup: 2000
  
      securityContext: 
          runAsNonRoot: true 
          runAsUser: 1000
          runAsGroup: 2000
          allowPrivilegeEscalation: false
          privileged: false
          readOnlyRootFilesystem: true
          capabilities:
              drop:
                  - all
  
      service:
          type: &quot;ClusterIP&quot;
          port: 8080
  
      ingress:
          enabled: true
          annotations:
              nginx.ingress.kubernetes.io/rewrite-target: &quot;/&quot;
          hosts:
            - host: chart-example.local
              paths: 
              - path: &quot;/my-test-app&quot;
  
      autoscaling:
          enabled: false
          
      serviceAccount:
          create: false
  </code></pre>
  <p>Obviously I am missing something or doing something wrong. Some help would be much appreciated because it seems I am stuck with this one. I get &quot;Permission denied&quot; or &quot;Failed to create CoreCLR, HRESULT: 0x80004005&quot;.</p>
  <p>Thanks in advance!</p>