0003: Ports 80 and 443 through a launchd socket handoff
Status: accepted
Context
Section titled “Context”macOS refuses unprivileged binds to loopback ports below 1024 (see Spikes). Binding the wildcard address would expose every site to the network, and running DevKit as root is not acceptable.
Decision
Section titled “Decision”A launchd daemon plist with a Sockets key binds 127.0.0.1:80 and :443 as root and hands the descriptors to devkitd, which runs as the user (UserName).
Consequences
Section titled “Consequences”No DevKit code runs as root and no signed privileged helper is needed. Setup needs one admin prompt to install the plist; removal needs another.