Darwin: attempt to bind to random port via `port 0` fails

malloc · March 22, 2026, 5:38pm

I am updating packages to include tests and observing the following error only on darwin systems – aarch64-darwin and x86_64-darwin:

`x86_64-darwin` (sandbox = relaxed)

:x: 1 package failed to build:

keto

Error logs: `x86_64-darwin`

keto

	net/http/httptest/server.go:120
net/http/httptest.NewServer({0x106ae9380, 0x3349015042e0})
	net/http/httptest/server.go:107 +0x25
github.com/ory/keto/internal/schema_test.TestNewHandler(0x334901577688)
	github.com/ory/keto/internal/schema/handler_test.go:36 +0x13a
testing.tRunner(0x334901577688, 0x106addc50)
	testing/testing.go:2036 +0xea
created by testing.(*T).Run in goroutine 1
	testing/testing.go:2101 +0x4c5
FAIL	github.com/ory/keto/internal/schema	2.853s
?   	github.com/ory/keto/internal/x	[no test files]
ok  	github.com/ory/keto/internal/x/dbx	2.039s
ok  	github.com/ory/keto/internal/x/graph	2.026s
ok  	github.com/ory/keto/internal/x/validate	0.837s
ok  	github.com/ory/keto/ketoapi	0.885s
ok  	github.com/ory/keto/ketoctx	1.776s
?   	github.com/ory/keto/ketodriver	[no test files]
?   	github.com/ory/keto/spec	[no test files]
?   	github.com/ory/keto/x/events	[no test files]
FAIL

`aarch64-darwin` (sandbox = relaxed)

:x: 1 package failed to build:

keto

Error logs: `aarch64-darwin`

keto

	net/http/httptest/server.go:120
net/http/httptest.NewServer({0x104e8c640, 0x3b667682530})
	net/http/httptest/server.go:107 +0x28
github.com/ory/keto/internal/schema_test.TestNewHandler(0x3b667c76d88)
	github.com/ory/keto/internal/schema/handler_test.go:36 +0x154
testing.tRunner(0x3b667c76d88, 0x104e80f30)
	testing/testing.go:2036 +0xc4
created by testing.(*T).Run in goroutine 1
	testing/testing.go:2101 +0x3a8
FAIL	github.com/ory/keto/internal/schema	0.072s
?   	github.com/ory/keto/internal/x	[no test files]
ok  	github.com/ory/keto/internal/x/dbx	0.021s
ok  	github.com/ory/keto/internal/x/graph	0.040s
ok  	github.com/ory/keto/internal/x/validate	0.012s
ok  	github.com/ory/keto/ketoapi	0.012s
ok  	github.com/ory/keto/ketoctx	0.024s
?   	github.com/ory/keto/ketodriver	[no test files]
?   	github.com/ory/keto/spec	[no test files]
?   	github.com/ory/keto/x/events	[no test files]
FAIL

Looking into the logs further, discover this is happening during checkPhase causing tests to fail:

github.com/ory/keto/internal/e2e/full_suit_test.go:63
keto>                   Error:          Received unexpected error:
keto>                                   unable to listen on "127.0.0.1:0": listen tcp 127.0.0.1:0: bind: operation not permitted

The same build/tests for aarch64-linux and x86_64-linux are successful:

`x86_64-linux`

:white_check_mark: 1 package built:

keto

`aarch64-linux`

:white_check_mark: 1 package built:

keto

What’s strange is that this package builds on my aarch64-darwin system just fine with nix-build -A keto:

nixpkgs on  pkgs/ory/keto/fix-check-phase [$] at 12:26:20 ❯ nix-build -A keto
warning: Nix search path entry '/nix/var/nix/profiles/per-user/root/channels' does not exist, ignoring
this derivation will be built:
  /nix/store/hzgb917ag3q6mlvhcpv5jnfp8vxmkp4p-keto-25.4.0.drv
building '/nix/store/hzgb917ag3q6mlvhcpv5jnfp8vxmkp4p-keto-25.4.0.drv'...
Using versionCheckHook
Running phase: unpackPhase
unpacking source archive /nix/store/5wbp98kx3rx8xdqzj6qgw4v34mvm3hjx-source
source root is source
Running phase: patchPhase
Running phase: updateAutotoolsGnuConfigScriptsPhase
Running phase: configurePhase
Running phase: buildPhase
Building subPackage ./.
Running phase: checkPhase
?       github.com/ory/keto     [no test files]
ok      github.com/ory/keto/cmd 0.830s
ok      github.com/ory/keto/cmd/check   0.466s
?       github.com/ory/keto/cmd/clidoc  [no test files]
ok      github.com/ory/keto/cmd/client  1.133s
ok      github.com/ory/keto/cmd/expand  1.473s
?       github.com/ory/keto/cmd/helpers [no test files]
ok      github.com/ory/keto/cmd/migrate 1.957s
ok      github.com/ory/keto/cmd/namespace       2.112s
ok      github.com/ory/keto/cmd/relationtuple   2.335s
?       github.com/ory/keto/cmd/server  [no test files]
ok      github.com/ory/keto/cmd/status  2.926s
?       github.com/ory/keto/contrib/docs-code-samples/expand-api-display-access/00-create-tuples        [no test files]
?       github.com/ory/keto/contrib/docs-code-samples/expand-api-display-access/01-expand-beach [no test files]
?       github.com/ory/keto/contrib/docs-code-samples/list-api-display-objects/00-create-tuples [no test files]
?       github.com/ory/keto/contrib/docs-code-samples/list-api-display-objects/01-list-PM       [no test files]
?       github.com/ory/keto/contrib/docs-code-samples/list-api-display-objects/02-list-coffee-break     [no test files]
?       github.com/ory/keto/contrib/docs-code-samples/simple-access-check-guide/00-write-direct-access  [no test files]
?       github.com/ory/keto/contrib/docs-code-samples/simple-access-check-guide/01-check-direct-access  [no test files]
?       github.com/ory/keto/contrib/docs-code-samples/simple-access-check-guide/99-cleanup      [no test files]
ok      github.com/ory/keto/embedx      2.545s
ok      github.com/ory/keto/internal/check      2.376s
ok      github.com/ory/keto/internal/check/checkgroup   2.815s
ok      github.com/ory/keto/internal/driver     2.856s
ok      github.com/ory/keto/internal/driver/config      3.590s
ok      github.com/ory/keto/internal/e2e        49.448s
ok      github.com/ory/keto/internal/expand     3.665s
?       github.com/ory/keto/internal/httpclient [no test files]
ok      github.com/ory/keto/internal/namespace  3.836s
?       github.com/ory/keto/internal/namespace/ast      [no test files]
?       github.com/ory/keto/internal/namespace/namespacehandler [no test files]
?       github.com/ory/keto/internal/persistence        [no test files]
ok      github.com/ory/keto/internal/persistence/sql    3.652s
ok      github.com/ory/keto/internal/persistence/sql/migrations/migratest       4.742s
ok      github.com/ory/keto/internal/persistence/sql/migrations/uuidmapping     3.958s
ok      github.com/ory/keto/internal/relationtuple      4.373s
ok      github.com/ory/keto/internal/schema     4.460s
?       github.com/ory/keto/internal/x  [no test files]
ok      github.com/ory/keto/internal/x/dbx      4.569s
ok      github.com/ory/keto/internal/x/graph    4.821s
ok      github.com/ory/keto/internal/x/validate 4.497s
ok      github.com/ory/keto/ketoapi     4.622s
ok      github.com/ory/keto/ketoctx     4.515s
?       github.com/ory/keto/ketodriver  [no test files]
?       github.com/ory/keto/spec        [no test files]
?       github.com/ory/keto/x/events    [no test files]
checkPhase completed in 55 seconds
Running phase: installPhase
Running phase: fixupPhase
checking for references to /nix/var/nix/builds/nix-28362-120335514/ in /nix/store/6pvzxkiyh9zd965jl7fqw2svkymmg1q3-keto-25.4.0...
patching script interpreter paths in /nix/store/6pvzxkiyh9zd965jl7fqw2svkymmg1q3-keto-25.4.0
stripping (with command strip and flags -S) in  /nix/store/6pvzxkiyh9zd965jl7fqw2svkymmg1q3-keto-25.4.0/bin
Running phase: installCheckPhase
Executing versionCheckPhase
Successfully managed to find version v25.4.0 in the output of the command /nix/store/6pvzxkiyh9zd965jl7fqw2svkymmg1q3-keto-25.4.0/bin/keto version
Version:                        v25.4.0
Build Commit:   f5635433a56324f266ea414727bf7395bb2da429
Build Timestamp:        undefined
Finished versionCheckPhase
no Makefile or custom installCheckPhase, doing nothing
/nix/store/6pvzxkiyh9zd965jl7fqw2svkymmg1q3-keto-25.4.0

The unable to listen on "127.0.0.1:0" ... error is a bit suspicious, but learned this is just a way for applications to dynamically bind to an available port on the system [1]. But, still not clear why it works on my darwin system but not via the nixpkgs-review-gha build.

Appreciate any insight into this issue.

[1] https://stackoverflow.com/a/1077305/5407923

malloc · March 22, 2026, 6:04pm

seems this may be a sandbox related issue. I re-ran nixpkgs-review-gha on darwin systems only with sandbox disabled and it’s now successful:

github.com/NixOS/nixpkgs

Comment by debtquity - keto: run partial test suite, add versionCheckPhase

master ← debtquity:pkgs/ory/keto/fix-check-phase

## `nixpkgs-review` result Generated using [`nixpkgs-review-gha`](https://githu…b.com/Defelo/nixpkgs-review-gha) Command: `nixpkgs-review pr 502025` Commit: [`952671d6a1b22a8c3bf0f905f6b458b6d660ff3e`](https://github.com/NixOS/nixpkgs/commit/952671d6a1b22a8c3bf0f905f6b458b6d660ff3e) ([subsequent changes](https://github.com/NixOS/nixpkgs/compare/952671d6a1b22a8c3bf0f905f6b458b6d660ff3e..pull/502025/head)) Merge: [`66615f0fda737310f2e0647c4ba35790d97d70c7`](https://github.com/NixOS/nixpkgs/commit/66615f0fda737310f2e0647c4ba35790d97d70c7) Logs: https://github.com/debtquity/nixpkgs-review-gha/actions/runs/23408763568 --- ### `x86_64-darwin` (sandbox = false) <details> <summary>:white_check_mark: 1 package built:</summary> <ul> <li>keto</li> </ul> </details> --- ### `aarch64-darwin` (sandbox = false) <details> <summary>:white_check_mark: 1 package built:</summary> <ul> <li>keto</li> </ul> </details>

follow up question: are builds on hydra for darwin systems using sandbox? If so, is there a way to get dynamic port assignment to work within sandbox build?

malloc · March 30, 2026, 10:36pm

after picking back up on this, discovered this may be resolved by [1]:

__darwinAllowLocalNetworking = true;

This allows for application to bind to ports in sandbox during checkPhase

Successful build with sandbox enabled on darwin systems: keto: run partial test suite, add versionCheckPhase by debtquity · Pull Request #502025 · NixOS/nixpkgs · GitHub

[1] Cannot bind and listen to port with macOS sandbox, even with __darwinAllowLocalNetworking · Issue #11269 · NixOS/nix · GitHub

Darwin: attempt to bind to random port via `port 0` fails

x86_64-darwin (sandbox = relaxed)

aarch64-darwin (sandbox = relaxed)

x86_64-linux

aarch64-linux

`x86_64-darwin` (sandbox = relaxed)

`aarch64-darwin` (sandbox = relaxed)

`x86_64-linux`

`aarch64-linux`