{"record":{"id":"5b9baf275fdc8680","repo":"cloudflare/cloudflared","slug":"cannot-start-hello-world-server","errorCode":null,"errorMessage":"Cannot start Hello World Server","messagePattern":"Cannot start Hello World Server","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/origin_service.go","lineNumber":234,"sourceCode":"}\n\nfunc (o *helloWorld) String() string {\n\treturn HelloWorldService\n}\n\n// Start starts a HelloWorld server and stores its address in the Service receiver.\nfunc (o *helloWorld) start(\n\tlog *zerolog.Logger,\n\tshutdownC <-chan struct{},\n\tcfg OriginRequestConfig,\n) error {\n\tif err := o.httpService.start(log, shutdownC, cfg); err != nil {\n\t\treturn err\n\t}\n\n\thelloListener, err := hello.CreateTLSListener(\"127.0.0.1:\")\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"Cannot start Hello World Server\")\n\t}\n\tgo hello.StartHelloWorldServer(log, helloListener, shutdownC)\n\to.server = helloListener\n\n\to.httpService.url = &url.URL{\n\t\tScheme: \"https\",\n\t\tHost:   o.server.Addr().String(),\n\t}\n\n\treturn nil\n}\n\nfunc (o helloWorld) MarshalJSON() ([]byte, error) {\n\treturn json.Marshal(o.String())\n}\n\n// statusCode is an OriginService that just responds with a given HTTP status.\n// Typical use-case is \"user wants the catch-all rule to just respond 404\".","sourceCodeStart":216,"sourceCodeEnd":252,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/origin_service.go#L216-L252","documentation":"The hello world origin service starts an internal HTTPS listener on 127.0.0.1 via hello.CreateTLSListener before launching the demo server. If the listener cannot be created (typically TLS certificate generation or port binding failure), the error is wrapped with this message and the service fails to start.","triggerScenarios":"Running with service 'hello_world' when hello.CreateTLSListener cannot bind to '127.0.0.1:' — e.g. no ephemeral ports available, or TLS listener creation errors.","commonSituations":"Testing cloudflared with hello_world in restricted environments (containers without loopback, exhausted file descriptors/ports), or a corrupted state preventing self-signed certificate generation.","solutions":["Check the wrapped inner error; if it is a bind failure, free ports or resources and retry.","Increase available file descriptors (ulimit -n) if EMFILE is reported.","Ensure 127.0.0.1 loopback networking is available in your container/sandbox.","If you did not intend the demo server, replace service: hello_world with your real origin URL."],"exampleFix":"// before (config.yml)\nservice: hello_world\n// after\nservice: http://localhost:8080","handlingStrategy":"try-catch","validationCode":"// Before choosing hello_world, verify loopback + ephemeral ports are usable\nl, err := net.Listen(\"tcp\", \"127.0.0.1:0\")\nif err != nil {\n    return fmt.Errorf(\"loopback listening unavailable: %w\", err)\n}\n_ = l.Close()","typeGuard":null,"tryCatchPattern":"if err := ing.StartOrigins(log, shutdownC); err != nil {\n    if strings.Contains(err.Error(), \"Hello World\") {\n        log.Warn().Msg(\"hello_world origin unavailable; falling back to http origin\")\n    }\n    return err\n}","preventionTips":["Use hello_world only for demos; point at a real origin in production configs.","Ensure loopback networking and adequate fd limits in containers.","Read the wrapped inner error to distinguish bind vs TLS listener failures."],"tags":["hello-world","tls","listener","startup"],"backgroundTag":"connection-refused","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}