MiroTalk Update regularly fails after update

[djxx]

@james Thanks for the quick reply. I didn't change any ports manually. Could it be that this and another application are conflicting and it's not being detected?

I'll run this lsof command next time it happens to see if I can identify the culprit.

[avatar1024]

I have had that happened with Mirotalk too,. Sometimes update get stuck. Happens less often these days but still sometimes. I either have to restart the app or remove and reinstall.

[MiroTalk]

Port allocation behavior

By default, when SFU_SERVER is set to false, the application uses a range of 100 ports.

when SFU_SERVER=true it allocate ports starting from 40000 default + CPU core eg if your server has 4CPU so become 40000 - 40003 (only 3 ports needed)

More about: https://mediasoup.discourse.group/t/mediasoups-webrtcserver-concerning-firewall-settings-and-port-binding/5965/5

---

Cloudron integration

To support this behavior on Cloudron, SFU_SERVER should be exposed as a toggle (switch button) in the MiroTalk SFU app settings (Location).
When the switch is enabled, the port allocation logic in start.sh can be updated something as follows:

# Enable / disable SFU server (default: false)
readonly SFU_SERVER="${SFU_SERVER:-false}"

# Number of CPU cores (used only when SFU is enabled)
readonly CPU_CORES="$(nproc)"

# Base TCP port (default: 25000)
readonly SFU_TCP_BASE="${SFU_TCP:-25000}"

if [[ "$SFU_SERVER" == "true" ]]; then
    # SFU enabled:
    # allocate one port per CPU core
    readonly SFU_MAX_PORT=$(( SFU_TCP_BASE + CPU_CORES - 1 ))
else
    # Default behavior:
    # allocate 100 ports starting from the base port
    readonly SFU_MAX_PORT=$(( SFU_TCP_BASE + 100 ))
fi

---

Benefits of this approach

• Fewer ports allocated
  Only the ports that are actually needed are opened, especially in SFU mode.

• Reduced port conflicts
  Smaller port ranges significantly lower the chance of clashes with other services on the same host.

• Better Cloudron compatibility
  Minimal port exposure aligns well with Cloudron’s strict networking and security model.

• Scales with hardware
  Port allocation automatically adapts to the number of CPU cores available.

• User control
  Exposing SFU_SERVER as a switch allows users to explicitly choose whether to run in SFU mode or keep the default behavior.

[james]

Hello @mirotalk
Does this have any other effects?

[MiroTalk]

@james said in MiroTalk Update regularly fails after update:

Does this have any other effects?

In theory, it shouldn’t have any other effects, as long as the user can switch between these two modes. I’m not entirely sure why Mediasoup doesn’t use a server SFU by default, but you could ask the Mediasoup support forum for clarification.

[djxx]

Is there any update on this? I can't rely on this app for meeting links because about 75% of the time it's not running properly due to startup failure.

[nebulon]

So this always happens when the app gets updated?

[djxx]

@nebulon It also happens after system updates or restarts. It seems it's a roll of the dice if the ports aren't already taken. Restarting the app doesn't fix it anymore, so now when it crashes I change the SFU TCP/UDP port range to something else and it works when the app restarts.

[robi]

Sounds like a firewall cleanup issue or maybe something in between

[nebulon]

When this happens, can you check which container is occupying those ports?

You can run

docker ps --format "table {{.ID}}\t{{.Names}}\t{{.Ports}}" | grep <portnumber>

which should reveal the container holding on to it.

[MiroTalk]

@djxx said:

Restarting the app doesn't fix it anymore, so now when it crashes I change the SFU TCP/UDP port range to something else and it works when the app restarts.

This issue can occur if another application is already using ports within the 40000–40100 range. To resolve it, you can either change the port range (for example, starting from 25000)

or enable WebRTC server mode in the env (edit it via Cloudron file manager), which requires fewer ports, as described above.

SFU_SERVER=true

Then restart the instance.

Edit: The second option requires implementation on the Cloudron side, as described here:
https://forum.cloudron.io/post/117374

[robi]

Why don't we have the second option as the more reliable packaged default?

[girish]

@djxx I think https://git.cloudron.io/platform/box/-/commit/b08e3a5128cdf2e036523c6d585adb0674ba95bf will help.

[djxx]

It's happening again, and this time I don't see a container conflict but rather a health check failure that it cant find it's public IP:

Mar 30 09:06:14 [3/30/2026, 16:06:14:098] [Server] Failed to detect IP from http://api.ipify.org 'getaddrinfo EAI_AGAIN api.ipify.org'
Mar 30 09:06:14 [3/30/2026, 16:06:14:101] [Server] Failed to detect IP from http://ipinfo.io/ip 'getaddrinfo EAI_AGAIN ipinfo.io'
Mar 30 09:06:14 [3/30/2026, 16:06:14:102] [Server] Failed to detect IP from http://ifconfig.me/ip 'getaddrinfo EAI_AGAIN ifconfig.me'
Mar 30 09:06:14 [3/30/2026, 16:06:14:103] [Server] Public IP detection failed 'All public IP detection services failed! Please check your network connection'
Mar 30 09:06:14 ⠙
Mar 30 09:06:23 => Healthcheck error: Error: connect EHOSTUNREACH 172.18.16.130:3010

When I check what is using port 3010, it's nodeJS running /home/yellowtent/box/box.js

[MiroTalk]

Mar 30 09:06:14 [3/30/2026, 16:06:14:098] [Server] Failed to detect IP from http://api.ipify.org 'getaddrinfo EAI_AGAIN api.ipify.org'
Mar 30 09:06:14 [3/30/2026, 16:06:14:101] [Server] Failed to detect IP from http://ipinfo.io/ip 'getaddrinfo EAI_AGAIN ipinfo.io'
Mar 30 09:06:14 [3/30/2026, 16:06:14:102] [Server] Failed to detect IP from http://ifconfig.me/ip 'getaddrinfo EAI_AGAIN ifconfig.me'
Mar 30 09:06:14 [3/30/2026, 16:06:14:103] [Server] Public IP detection failed 'All public IP detection services failed! Please check your network connection'

This looks like a network-related issue rather than something specific to MiroTalk.

If SFU_ANNOUNCED_IP is not configured, the system will automatically rely on three external services to determine the instance’s public IPv4 address.

---

Is there a firewall or network filter in between that might be blocking traffic?

---

NOTE: As I can see, on Cloudron this is handled by the command in:
https://git.cloudron.io/packages/mirotalksfu-app/-/blob/main/start.sh#L39

If it fails (mean not set SFU_ANNOUNCED_IP), MiroTalk SFU uses an internal fallback mechanism that queries three external services in sequence to determine a valid public IPv4 address for the instance.

[djxx]

@MiroTalk I can't speak for what Cloudron is doing - but after changing the port ranges again and restarting the app, it starts working again. Perhaps there's a step (getting the public IP) that only happens on reconfiguration but the app expects it to happen on every start?

[girish]

@djxx unfortunately, my fix (in 9.1.6) did not work. I am looking into a more involved fix.

[girish]

I missed a retry in start container - https://git.cloudron.io/platform/box/-/commit/4ba9c63eb41d663e805f72257cc37774f401265b