The executable that’s actually opening the port is the BEAM VM. Start iex in one window, then run ps aux | grep beam in another to see the details of the process. In my case, the executable is /usr/lib/erlang/erts-7.2/bin/beam.smp. Try setting the capabilities on that file instead.

Update: confirmed on Ubuntu 14.04.

$ sudo setcap 'cap_net_bind_service=+ep' /usr/lib/erlang/erts-7.2/bin/beam.smp
$ iex
Erlang/OTP 18 [erts-7.2] [source] [64-bit] [smp:4:4] [async-threads:10] [hipe] [kernel-poll:false]

Interactive Elixir (1.2.0) - press Ctrl+C to exit (type h() ENTER for help)
iex(1)> :gen_tcp.listen(443, [])
{:ok, #Port<0.1426>}
iex(2)>

Got it! I had to use setcap on a file distillery created called run_erl. On my system it was:
sudo setcap CAP_NET_BIND_SERVICE=+eip /home/ubuntu/myapp/_build/prod/rel/myapp/erts-8.1/bin/run_erl

Now I can start the web server from its run script and with just sudo start myapp (since I’d already created the /etc/init/myapp.conf script)

Wow this was a bit of a rabbit but it should be easier for the next person searching on google. Thanks @voltone

I’ll definitely keep your idea in mind too, @bobbypriambodo. Nginx is always a possibility in the future if I need it for filtering spammy requests to “admin.php” and other non-existent URLs that seem to be popular for bots to hit.

On Ubuntu you can alternatively use authbind, which lets an administrator grant permissions to bind to specific ports by user/group. This means the permission is not bound to any particular application binary, and therefore persists when the binary is updated.

…and probably after it’s been deployed I suspect that tar doesn’t preserve capabilities on archived files.

On FreeBSD I just bind ports 80 and 443 to ports 8080 and 8443, respectively, with pf. And start the app without any need for sudo. I think it’s also possible on Linux, albeit with another firewall.