Port 9000: PHP-FPM / MinIO / SonarQube

What uses port 9000

PHP-FPM listens on 127.0.0.1:9000 for FastCGI requests from nginx; MinIO serves its S3 API on 9000 (console on 9001); SonarQube’s web UI and Portainer’s HTTP port also default to 9000. If two of these run on one machine, one has to move.

Should port 9000 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• An exposed PHP-FPM port lets anyone run PHP files on the server. Keep it on localhost or use a Unix socket (listen = /run/php/php-fpm.sock).

Check what is listening on port 9000

sudo ss -ltnp 'sport = :9000'

sudo lsof -nP -iTCP:9000 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 9000 -State Listen
netstat -ano | findstr :9000

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 9000

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:9000 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 9000 -State Listen).OwningProcess

Allow port 9000 from trusted networks only

The examples allow 9000 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 9000 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 9000 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="9000" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "PHP-FPM / MinIO / SonarQube 9000/TCP" -Direction Inbound -Protocol TCP -LocalPort 9000 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 9000 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 9000:9000 would expose the port to the whole network.
docker run -d -p 127.0.0.1:9000:9000 minio/minio

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 9000 from another machine

nc -zv example.com 9000

Test-NetConnection example.com -Port 9000

Related ports

• Port 80 (HTTP): the default port for HTTP, unencrypted web traffic.
• Port 9090 (Prometheus): the default port of the Prometheus server.

More development servers ports

3000 (Development server / Grafana) , 4200 (Angular dev server) , 5000 (Flask / development servers) , 5173 (Vite dev server) , 8000 (Development server (Django, Python)) , 8888 (Jupyter) , 9418 (Git protocol) . See all ports in the port lookup.

Sources

• IANA port registry (not registered for this use)

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions