Docker "port is already allocated" and "ports are not available": find who has the port

1. Another container

By far the most common, often a forgotten old run:

docker ps --filter publish=8080

CONTAINER ID   IMAGE       COMMAND                  PORTS                  NAMES
f3a91c2d7b10   nginx:1.27  "/docker-entrypoint.…"   0.0.0.0:8080->80/tcp   old-web

Stop it. A container that’s only stopped doesn’t hold its port:

docker stop old-web
docker rm old-web

2. Docker Compose

Another project might be using the port, since each folder is its own project by default:

docker compose ls
docker ps --format 'table {{.Names}}\t{{.Ports}}\t{{.Label "com.docker.compose.project"}}'

Bring it down from its folder, or by name:

docker compose -p other-project down

The terminal has this situation ready: find the project that holds 8080, bring it down by name, then start yours.

Two services in one file can’t publish the same host port, either. To run several copies of a project, make the port a variable:

services:
  web:
    ports:
      - "${WEB_PORT:-8080}:80"

docker compose up --scale web=2 fails the same way with a fixed port, as both copies ask for it.

Use the Docker Compose Generator to get the file. It only publishes what you ask for.

3. Another program

sudo ss -tlnp | grep ':8080 '
sudo lsof -i :8080 -sTCP:LISTEN

If the last column of ss says docker-proxy, that’s a container, so go back to section 1. Anything else is a program on the host, such as a local web server or a development server you left running. To find what it is, and stop it for good, see address already in use. The Port Lookup tells you what normally runs on a port.

On a Mac:

sudo lsof -nP -iTCP:8080 -sTCP:LISTEN

macOS itself holds port 5000 and 7000, for AirPlay Receiver. Turn it off in System Settings → General → AirDrop & Handoff, or use another port.

4. Nothing’s using it

docker ps and ss show nothing, and the error stays. The daemon may be holding on to it after a crash, or from a container that exited badly. Restart Docker:

sudo systemctl restart docker

On Docker Desktop, use Restart from its menu. Note that restarting stops containers too, except those set up to come back.

5. Windows: excluded port ranges

The “forbidden by its access permissions” message usually means Windows has reserved that port for itself, and no program is using it at all. So your Get-NetTCPConnection shows nothing. See the reserved ranges:

netsh interface ipv4 show excludedportrange protocol=tcp

Start Port    End Port
----------    --------
      7913        8012
      8013        8112

Hyper-V and WSL reserve ranges like these at boot, and they can change on each restart. So 8080 may work today, and not tomorrow. You’ve got a few options:

Choose a port that’s outside the ranges. That’s the simple answer.

Reset them, in an administrator PowerShell. This frees them until the next reservation:

net stop winnat
net start winnat

Reserve your port permanently, so that Windows leaves it alone. While winnat is stopped:

net stop winnat
netsh int ipv4 add excludedportrange protocol=tcp startport=8080 numberofports=1 store=persistent
net start winnat

Or move Windows’s dynamic range away from common ports:

netsh int ipv4 set dynamic tcp start=49152 num=16384

6. Other Ports-are-not-available messages

For rootless Docker, use a port above 1024, or allow it with sudo sysctl net.ipv4.ip_unprivileged_port_start=80.

7. Publish on a specific address

A port is held per address. You can run two things on one port, if each one uses its own address:

docker run -p 127.0.0.1:8080:80 nginx
docker run -p 10.0.0.5:8080:80 nginx

And 127.0.0.1 is a good idea anyway, for anything that shouldn’t be public.