Introduction

Spring Boot runs on port 8080 by default, but changing the application to serve on port 80 is easy at the framework level. The real complexity is usually the operating system, because binding to low-numbered ports on Unix-like systems often requires elevated privileges or a safer workaround.

Changing the Spring Boot Port

At the application level, the port change is straightforward. Set server.port=80 in properties, or the equivalent value in YAML.

server.port=80

server:
  port: 80

You can also override it from the command line:

java -jar app.jar --server.port=80

If the process has permission to bind to port 80, the application will start there.

Why Port 80 Can Fail on Linux and macOS

On many Unix-like systems, ports below 1024 are privileged. A normal unprivileged process cannot bind to them directly, so a Spring Boot application launched as a regular user may fail with a permission error even though the configuration is correct.

Running the whole Java process as root is technically possible, but it is usually a poor operational choice. If the application or one of its dependencies is compromised, the process has far more power than it needs.

Recommended Approach: Reverse Proxy

In production, the common pattern is to keep Spring Boot on an unprivileged port such as 8080 and let a reverse proxy listen on 80.

1server {
2    listen 80;
3    server_name example.com;
4
5    location / {
6        proxy_pass http://127.0.0.1:8080;
7        proxy_set_header Host $host;
8        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
9        proxy_set_header X-Forwarded-Proto $scheme;
10    }
11}

This design is usually better for security and operations. The proxy can also handle TLS termination, compression, access logs, and routing rules, while the Spring Boot process stays unprivileged.

Direct Binding Without Running as root

If you truly want the Java process itself to listen on 80, use a platform-specific mechanism that grants bind permission without full root execution. On Linux, one common option is setcap.

sudo setcap 'cap_net_bind_service=+ep' /path/to/java

After that, the Java binary can bind to privileged ports such as 80 without running the process as root. This works, but it is still more operationally delicate than a reverse proxy, especially when Java installations are upgraded or managed by a package system.

Some environments also support tools such as authbind, which grant low-port binding for a specific command or user.

Containers and Port Mapping

If the application runs in Docker, you often do not need the process to bind to 80 inside the container. Keep Spring Boot on 8080 internally and publish container port 8080 as host port 80.

docker run -p 80:8080 my-spring-app

That gives clients port 80 access while leaving the application itself on its normal internal port.

Forwarded Headers

When a reverse proxy is involved, the application should understand forwarded headers so links, redirects, and security logic reflect the external request correctly. In Spring Boot, that usually means enabling the correct forward-header strategy for your deployment.

This matters most when the proxy terminates TLS or when the application needs to know the original host and scheme.

Common Pitfalls

Setting server.port=80 in configuration is not enough if the process lacks permission to bind to privileged ports.

Running the entire application as root solves the symptom but creates avoidable security risk.

Forgetting reverse-proxy headers can cause bad redirect URLs, incorrect scheme detection, or broken authentication callbacks.

Granting capabilities to one Java binary and then upgrading Java can silently remove the permission, causing confusing deployment failures later.

Inside containers, many people change the internal application port unnecessarily even though host-port mapping already solves the problem.

Summary

• Spring Boot can be configured to use port 80 with server.port=80.
• On Unix-like systems, binding to 80 often requires special permission.
• The safest production setup is usually a reverse proxy on 80 forwarding to Spring Boot on 8080.
• Direct binding can be done with tools such as setcap, but it is a more delicate setup.
• In containerized deployments, host-port mapping is often the simplest answer.