Systemd has socket units that could support this, though it requires cooperation from the listening program.

In case anyone wonders what the cooperation is, normally when you start a program on Linux you get three open file handles: standard input, standard output and standard error. But if you use systemd socket activation, then when your program starts you get an additional open file handle per port.

So rather than binding to a port, you ask your webserver library to listen for requests on the extra file handle. De facto, this means the application author needs cooperation from their webserver library - it needs to have been written so that it has the option to listen from an open file handle rather than binding to a port and listening to the file handle it gets as a result of that bind. But since this is a reasonably common usecase, and basically just half of the normal process, you might discover that the library you're already using has support for it.

On the other hand, AFAIK docker doesn't support socket activation, so if you use docker to provide your runtime it's game over.

podman supports systemd socket activation, however.

Socket activation means systemd is the listener, and has higher priority.

Other forms of activation... idk maybe the same essence. files and dirs and processes are all owned by someone.

I don't claim to have thought all angles out, and don't even claim it's a good idea, just a response to a specific point about first-come-first-serve.