Run MCP Gateway on port 8080 instead of 80 and update firewall rules

[lpcox]

Problem

When running the MCP Gateway container as a non-root user (via --user $(id -u):$(id -g) from #26658), binding to port 80 fails with:

HTTP server error: listen tcp 0.0.0.0:80: bind: permission denied

Port 80 is a privileged port (<1024) and requires either root or CAP_NET_BIND_SERVICE. This was observed in CI: https://github.com/github/gh-aw/actions/runs/24607686133/job/71956606316

Proposed Fix

1. Change the gateway listen port from 80 to 8080 in the container launch configuration. Port 8080 is non-privileged and does not require root or special capabilities.

2. Update firewall rules to allow traffic on port 8080 instead of (or in addition to) port 80 for the gateway container.

3. Update --add-host / DNS configuration — the same CI run also showed host.docker.internal DNS lookup failure for the safeoutputs HTTP backend. Ensure the container is launched with --add-host host.docker.internal:host-gateway or equivalent so that HTTP backends using host.docker.internal can resolve correctly.

4. Update any hardcoded port 80 references in gh-aw that generate the gateway container run command or construct URLs to the gateway (e.g., http://127.0.0.1:80/mcp/... → http://127.0.0.1:8080/mcp/...).

Context

• The MCP Gateway default port is 3000 (Go binary flag default), but gh-aw overrides it to 80 at container launch time via --listen 0.0.0.0:80
• Port 8080 is the conventional non-privileged HTTP alternative
• This is a prerequisite for running the gateway as non-root (Eliminate persistent “Redact secrets in logs” warnings by running MCP gateway as runner user #26658)
• Related mcpg issues: Make /etc/hosts write non-fatal for non-root container execution gh-aw-mcpg#3985 (/etc/hosts write fix), Add --group-add for Docker socket access when running gateway as non-root #26749 (--group-add for Docker socket)

Acceptance Criteria

• Gateway container listens on port 8080 (or another non-privileged port)
• Firewall rules updated to permit traffic on the new port
• host.docker.internal resolves inside the gateway container
• Gateway URLs in output config use the correct port
• CI passes with non-root container execution