Skip to content

Neo4j-Bolt Plugin binds to random ephemeral port, ignoring configuration #3809

Description

@Krinco1

Neo4j-Bolt plugin binds to random ephemeral port instead of configured port

ArcadeDB Version: 26.4.1-SNAPSHOT (Docker image arcadedata/arcadedb:latest, build 9bb3a5b)
OS: Linux 6.6.87.2-microsoft-standard-WSL2 (Docker container)
Java: OpenJDK 21.0.10 (Temurin-21.0.10+7)

Description

When enabling the Neo4j-Bolt plugin via arcadedb.server.plugins, the Bolt server
binds to a random ephemeral port on each startup instead of a deterministic,
configurable port. This makes it impossible to use the Bolt protocol in any
deployment scenario that requires port mapping (Docker, Kubernetes, firewalls).

Steps to Reproduce

  1. Start ArcadeDB with Bolt plugin enabled:

docker run -d --name arcadedb
-p 2480:2480 -p 7687:7687
-e JAVA_OPTS="-Xmx2g"
-e arcadedb.server.rootPassword=test1234
-e "arcadedb.server.plugins=Neo4j-Bolt:com.arcadedb.server.bolt.BoltServer"
arcadedata/arcadedb:latest

  1. Check which ports are listening inside the container:

docker exec arcadedb netstat -tlnp

  1. Observe that the Bolt server is NOT on port 7687 (or any other standard port),
    but on a random high port like 41095, 42151, 44457, etc.

Attempted Configuration Methods (all ignored)

  • -e arcadedb.bolt.port=7687
  • -e arcadedb.server.bolt.port=7687
  • -Darcadedb.bolt.port=7687 via JAVA_OPTS
  • -Darcadedb.server.bolt.port=7687 via JAVA_OPTS
  • -Darcadedb.bolt.host=0.0.0.0 via JAVA_OPTS

None of these change the actual port the Bolt server binds to.

Expected Behavior

The Bolt server should:

  1. Bind to a deterministic, well-known port (e.g., 7687, matching Neo4j convention)
  2. Respect configuration via arcadedb.bolt.port or equivalent property
  3. Log the actual port it binds to during startup

Actual Behavior

  • Bolt plugin loads successfully (visible in startup log: Starting ArcadeDB Server in development mode with
    plugins [AutoBackupSchedulerPlugin, Neo4j-Bolt])
  • The arcadedb-bolt-26.4.1-SNAPSHOT-shaded.jar is present in /home/arcadedb/lib/
  • But netstat shows only HTTP (2480), metrics (9998/9999), and a random ephemeral port
  • The random port changes on every container restart
  • No log line indicates which port Bolt actually bound to
  • Connecting with neo4j-driver (v6.0.1) to any of these ports fails with "Connection was closed by server"

Impact

This effectively makes the Bolt protocol unusable in production because:

  • Docker port mapping requires knowing the internal port at container creation time
  • Kubernetes Services require a fixed targetPort
  • Firewall rules cannot be configured for random ports
  • The Bolt port cannot be advertised to clients

Workaround

Using the HTTP REST API (POST /api/v1/command/{database}) with language: "cypher" works correctly as an
alternative for Cypher query execution. However, this prevents using the widely-adopted neo4j-driver ecosystem
and its connection pooling, transaction management, and routing capabilities.

Environment Details

  • Docker image: arcadedata/arcadedb:latest (pulled 2026-04-06)
  • Confirmed the Bolt JAR exists: arcadedb-bolt-26.4.1-SNAPSHOT-shaded.jar
  • Available query languages confirmed: [sqlscript, mongo, gremlin, java, cypher, js, graphql, redis, sql,
    opencypher]
  • neo4j-driver v6.0.1 (Node.js) used for testing

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions