This looks like a network-related issue rather than something specific to MiroTalk.

If SFU_ANNOUNCED_IP is not configured, the system will automatically rely on three external services to determine the instance’s public IPv4 address.

Is there a firewall or network filter in between that might be blocking traffic?

NOTE: As I can see, on Cloudron this is handled by the command in:
https://git.cloudron.io/packages/mirotalksfu-app/-/blob/main/start.sh#L39

If it fails (mean not set SFU_ANNOUNCED_IP), MiroTalk SFU uses an internal fallback mechanism that queries three external services in sequence to determine a valid public IPv4 address for the instance.

Mar 30 09:06:14 [3/30/2026, 16:06:14:098] [Server] Failed to detect IP from http://api.ipify.org 'getaddrinfo EAI_AGAIN api.ipify.org'
Mar 30 09:06:14 [3/30/2026, 16:06:14:101] [Server] Failed to detect IP from http://ipinfo.io/ip 'getaddrinfo EAI_AGAIN ipinfo.io'
Mar 30 09:06:14 [3/30/2026, 16:06:14:102] [Server] Failed to detect IP from http://ifconfig.me/ip 'getaddrinfo EAI_AGAIN ifconfig.me'
Mar 30 09:06:14 [3/30/2026, 16:06:14:103] [Server] Public IP detection failed 'All public IP detection services failed! Please check your network connection'
Mar 30 09:06:14 ⠙
Mar 30 09:06:23 => Healthcheck error: Error: connect EHOSTUNREACH 172.18.16.130:3010

When I check what is using port 3010, it's nodeJS running /home/yellowtent/box/box.js

@djxx said:

Restarting the app doesn't fix it anymore, so now when it crashes I change the SFU TCP/UDP port range to something else and it works when the app restarts.

This issue can occur if another application is already using ports within the 40000–40100 range. To resolve it, you can either change the port range (for example, starting from 25000)

or enable WebRTC server mode in the env (edit it via Cloudron file manager), which requires fewer ports, as described above.

SFU_SERVER=true

Then restart the instance.

Edit: The second option requires implementation on the Cloudron side, as described here:
https://forum.cloudron.io/post/117374

You can run

docker ps --format "table {{.ID}}\t{{.Names}}\t{{.Ports}}" | grep <portnumber>

which should reveal the container holding on to it.

Does this have any other effects?

In theory, it shouldn’t have any other effects, as long as the user can switch between these two modes. I’m not entirely sure why Mediasoup doesn’t use a server SFU by default, but you could ask the Mediasoup support forum for clarification.

By default, when SFU_SERVER is set to false, the application uses a range of 100 ports.

when SFU_SERVER=true it allocate ports starting from 40000 default + CPU core eg if your server has 4CPU so become 40000 - 40003 (only 3 ports needed)

More about: https://mediasoup.discourse.group/t/mediasoups-webrtcserver-concerning-firewall-settings-and-port-binding/5965/5

Cloudron integration

To support this behavior on Cloudron, SFU_SERVER should be exposed as a toggle (switch button) in the MiroTalk SFU app settings (Location).
When the switch is enabled, the port allocation logic in start.sh can be updated something as follows:

# Enable / disable SFU server (default: false)
readonly SFU_SERVER="${SFU_SERVER:-false}"

# Number of CPU cores (used only when SFU is enabled)
readonly CPU_CORES="$(nproc)"

# Base TCP port (default: 25000)
readonly SFU_TCP_BASE="${SFU_TCP:-25000}"

if [[ "$SFU_SERVER" == "true" ]]; then
    # SFU enabled:
    # allocate one port per CPU core
    readonly SFU_MAX_PORT=$(( SFU_TCP_BASE + CPU_CORES - 1 ))
else
    # Default behavior:
    # allocate 100 ports starting from the base port
    readonly SFU_MAX_PORT=$(( SFU_TCP_BASE + 100 ))
fi

Benefits of this approach

• Fewer ports allocated
  Only the ports that are actually needed are opened, especially in SFU mode.

• Reduced port conflicts
  Smaller port ranges significantly lower the chance of clashes with other services on the same host.

• Better Cloudron compatibility
  Minimal port exposure aligns well with Cloudron’s strict networking and security model.

• Scales with hardware
  Port allocation automatically adapts to the number of CPU cores available.

• User control
  Exposing SFU_SERVER as a switch allows users to explicitly choose whether to run in SFU mode or keep the default behavior.

I'll run this lsof command next time it happens to see if I can identify the culprit.

Since your error is the following:

Docker Error: (HTTP code 500) server error - failed to set up container networking: driver failed programming external connectivity on endpoint a877975d-38be-4088-bc92-e0d7a486a818 (2e5adaa635a95bd65ca0f290712065d444528e3420c49f2f88323b40c62caaa5): failed to bind host port for 0.0.0.0:40014:172.18.16.130:40014/tcp: address already in use

it reveals you have changed the ports to 40000 'ish.
Could you please confirm what port you have chosen?
From the ports you have chosen you can run the following command in ssh to see if any other application is already using the the ports:
If you have chosen 40000 then the Mirotalk app uses 100 ports of so 40000 to 40100.

lsof -i :40000-40100