{"record":{"id":"88b1713d92d4f3cc","repo":"lima-vm/lima","slug":"invalid-socks-port-d","errorCode":null,"errorMessage":"invalid socks port %d","messagePattern":"invalid socks port (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/limactl/tunnel.go","lineNumber":65,"sourceCode":"\treturn tunnelCmd\n}\n\nfunc tunnelAction(cmd *cobra.Command, args []string) error {\n\tctx := cmd.Context()\n\tflags := cmd.Flags()\n\ttunnelType, err := flags.GetString(\"type\")\n\tif err != nil {\n\t\treturn err\n\t}\n\tif tunnelType != \"socks\" {\n\t\treturn fmt.Errorf(\"unknown tunnel type: %#q\", tunnelType)\n\t}\n\tport, err := flags.GetInt(\"socks-port\")\n\tif err != nil {\n\t\treturn err\n\t}\n\tif port != 0 && (port < 1024 || port > 65535) {\n\t\treturn fmt.Errorf(\"invalid socks port %d\", port)\n\t}\n\tstdout, stderr := cmd.OutOrStdout(), cmd.ErrOrStderr()\n\tinstName := args[0]\n\tinst, err := store.Inspect(ctx, instName)\n\tif err != nil {\n\t\tif errors.Is(err, os.ErrNotExist) {\n\t\t\treturn fmt.Errorf(\"instance %#q does not exist, run `limactl create %s` to create a new instance\", instName, instName)\n\t\t}\n\t\treturn err\n\t}\n\tif inst.Status == limatype.StatusStopped {\n\t\treturn fmt.Errorf(\"instance %#q is stopped, run `limactl start %s` to start the instance\", instName, instName)\n\t}\n\n\tif port == 0 {\n\t\tport, err = freeport.TCP()\n\t\tif err != nil {\n\t\t\treturn err","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/cmd/limactl/tunnel.go#L47-L83","documentation":"The SOCKS listener port given via `--socks-port` must be an ephemeral port (0 = auto-pick) or an unprivileged port in 1024–65535. Ports below 1024 (privileged) are rejected by this check before the tunnel starts.","triggerScenarios":"Running `limactl tunnel --socks-port 80` or `--socks-port 443` (or any value <1024 other than 0), or a value above 65535 if the flag parsing allows it.","commonSituations":"Trying to reuse a well-known port for the local SOCKS proxy; port assumptions from other proxy tools; scripting that passes a service port instead of a free local port.","solutions":["Use an unprivileged port, e.g. `--socks-port 1080`","Omit `--socks-port` (or pass 0) to let Lima pick a free port automatically","Run as root only if you truly must bind a privileged port (not supported by this flag check)"],"exampleFix":"// before\nlimactl tunnel --socks-port 808 myinstance   # still <1024\n// after\nlimactl tunnel --socks-port 1080 myinstance","handlingStrategy":"validation","validationCode":"port, _ := strconv.Atoi(socksPort)\nif port != 0 && (port < 1024 || port > 65535) {\n\treturn fmt.Errorf(\"socks port %d out of range; use 0 (auto) or 1024-65535\", port)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use ports >= 1024 for the SOCKS listener","Pass 0 or omit --socks-port to auto-select a free port","Never hardcode well-known ports (<1024) for local proxies"],"tags":["cli","tunnel","port","socks"],"backgroundTag":"invalid-port-range","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}