Port 8888: Jupyter

What uses port 8888

jupyter lab and jupyter notebook serve on http://localhost:8888 with a login token in the URL. A Jupyter server can run arbitrary code, so anyone who reaches it without a token or password controls the machine.

Should port 8888 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• To use Jupyter on a remote server, keep it on localhost and tunnel: ssh -L 8888:localhost:8888 user@server, then open the URL with the token locally.

Check what is listening on port 8888

sudo ss -ltnp 'sport = :8888'

sudo lsof -nP -iTCP:8888 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 8888 -State Listen
netstat -ano | findstr :8888

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 8888

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:8888 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 8888 -State Listen).OwningProcess

Allow port 8888 from trusted networks only

The examples allow 8888 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 8888 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 8888 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="8888" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "Jupyter 8888/TCP" -Direction Inbound -Protocol TCP -LocalPort 8888 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 8888 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 8888:8888 would expose the port to the whole network.
docker run -d -p 127.0.0.1:8888:8888 quay.io/jupyter/base-notebook

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 8888 from another machine

nc -zv example.com 8888

Test-NetConnection example.com -Port 8888

Related ports

• Port 8000 (Development server (Django, Python)): a common port for development servers, including Django and Python’s http.server.
• Port 8080 (HTTP alternate): the most common alternate HTTP port, used by proxies, app servers and dev tools.

More development servers ports

3000 (Development server / Grafana) , 4200 (Angular dev server) , 5000 (Flask / development servers) , 5173 (Vite dev server) , 9000 (PHP-FPM / MinIO / SonarQube) , 9418 (Git protocol) . See all ports in the port lookup.

Sources

• IANA port registry (not registered for this use)

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions