What causes "Cannot start Hello World Server" in cloudflare/cloudflared?

Check the wrapped inner error; if it is a bind failure, free ports or resources and retry.

Cannot start Hello World Server

Error message

Cannot start Hello World Server

What it means

The hello world origin service starts an internal HTTPS listener on 127.0.0.1 via hello.CreateTLSListener before launching the demo server. If the listener cannot be created (typically TLS certificate generation or port binding failure), the error is wrapped with this message and the service fails to start.

Source

Thrown at ingress/origin_service.go:234

}

func (o *helloWorld) String() string {
	return HelloWorldService
}

// Start starts a HelloWorld server and stores its address in the Service receiver.
func (o *helloWorld) start(
	log *zerolog.Logger,
	shutdownC <-chan struct{},
	cfg OriginRequestConfig,
) error {
	if err := o.httpService.start(log, shutdownC, cfg); err != nil {
		return err
	}

	helloListener, err := hello.CreateTLSListener("127.0.0.1:")
	if err != nil {
		return errors.Wrap(err, "Cannot start Hello World Server")
	}
	go hello.StartHelloWorldServer(log, helloListener, shutdownC)
	o.server = helloListener

	o.httpService.url = &url.URL{
		Scheme: "https",
		Host:   o.server.Addr().String(),
	}

	return nil
}

func (o helloWorld) MarshalJSON() ([]byte, error) {
	return json.Marshal(o.String())
}

// statusCode is an OriginService that just responds with a given HTTP status.
// Typical use-case is "user wants the catch-all rule to just respond 404".

View on GitHub (pinned to 2253eeeb25)

Solutions

Check the wrapped inner error; if it is a bind failure, free ports or resources and retry.
Increase available file descriptors (ulimit -n) if EMFILE is reported.
Ensure 127.0.0.1 loopback networking is available in your container/sandbox.
If you did not intend the demo server, replace service: hello_world with your real origin URL.

Example fix

// before (config.yml)
service: hello_world
// after
service: http://localhost:8080

Defensive patterns

Strategy: try-catch

Validate before calling

// Before choosing hello_world, verify loopback + ephemeral ports are usable
l, err := net.Listen("tcp", "127.0.0.1:0")
if err != nil {
    return fmt.Errorf("loopback listening unavailable: %w", err)
}
_ = l.Close()

Try / catch

if err := ing.StartOrigins(log, shutdownC); err != nil {
    if strings.Contains(err.Error(), "Hello World") {
        log.Warn().Msg("hello_world origin unavailable; falling back to http origin")
    }
    return err
}

Prevention

Use hello_world only for demos; point at a real origin in production configs.
Ensure loopback networking and adequate fd limits in containers.
Read the wrapped inner error to distinguish bind vs TLS listener failures.

When it happens

Trigger: Running with service 'hello_world' when hello.CreateTLSListener cannot bind to '127.0.0.1:' — e.g. no ephemeral ports available, or TLS listener creation errors.

Common situations: Testing cloudflared with hello_world in restricted environments (containers without loopback, exhausted file descriptors/ports), or a corrupted state preventing self-signed certificate generation.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/5b9baf275fdc8680. Report an issue: GitHub.