buildgrid/_app/commands/cmd_server.py

@@ -24,6 +24,7 @@ import sys
 
 import click
 
+from buildgrid._exceptions import PermissionDeniedError
 from buildgrid.server._authentication import AuthMetadataMethod, AuthMetadataAlgorithm
 from buildgrid.server.instance import BuildGridServer
 from buildgrid.server._monitoring import MonitoringOutputType, MonitoringOutputFormat
@@ -120,8 +121,13 @@ def _create_server_from_config(configuration):
 
     server = BuildGridServer(**kargs)
 
-    for channel in network:
-        server.add_port(channel.address, channel.credentials)
+    try:
+        for channel in network:
+            server.add_port(channel.address, channel.credentials)
+
+    except PermissionDeniedError as e:
+        click.echo("Error: {}.".format(e), err=True)
+        sys.exit(-1)
 
     for instance in instances:
         instance_name = instance['name']

buildgrid/_exceptions.py

@@ -89,3 +89,9 @@ class FailedPreconditionError(BgdError):
     able to fix the errors and retry."""
     def __init__(self, message, detail=None, reason=None):
         super().__init__(message, detail=detail, domain=ErrorDomain.SERVER, reason=reason)
+
+
+class PermissionDeniedError(BgdError):
+    """The caller does not have permission to execute the specified operation."""
+    def __init__(self, message, detail=None, reason=None):
+        super().__init__(message, detail=detail, domain=ErrorDomain.SERVER, reason=reason)

buildgrid/server/instance.py

@@ -27,6 +27,7 @@ import grpc
 import janus
 
 from buildgrid._enums import BotStatus, LogRecordLevel, MetricRecordDomain, MetricRecordType
+from buildgrid._exceptions import PermissionDeniedError
 from buildgrid._protos.buildgrid.v2 import monitoring_pb2
 from buildgrid.server.actioncache.service import ActionCacheService
 from buildgrid.server._authentication import AuthMetadataMethod, AuthMetadataAlgorithm
@@ -87,7 +88,8 @@ class BuildGridServer:
             AuthContext.interceptor = self.__grpc_auth_interceptor
 
         self.__grpc_executor = futures.ThreadPoolExecutor(max_workers)
-        self.__grpc_server = grpc.server(self.__grpc_executor)
+        self.__grpc_server = grpc.server(self.__grpc_executor,
+                                         options=(('grpc.so_reuseport', 0),))
 
         self.__main_loop = asyncio.get_event_loop()
 
@@ -205,6 +207,9 @@ class BuildGridServer:
 
         Returns:
             int: Number of the bound port.
+
+        Raises:
+            PermissionDeniedError: If socket binding fails.
         """
         if credentials is not None:
             self.__logger.info("Adding secure connection on: [%s]", address)
@@ -214,6 +219,9 @@ class BuildGridServer:
             self.__logger.info("Adding insecure connection on [%s]", address)
             port_number = self.__grpc_server.add_insecure_port(address)
 
+        if not port_number:
+            raise PermissionDeniedError("Unable to configure socket")
+
         return port_number
 
     def add_execution_instance(self, instance, instance_name):