Port 5000: Flask / development servers

What uses port 5000

flask run serves on 127.0.0.1:5000, and ASP.NET Core development profiles and the Docker registry (registry:2) also default to 5000. On macOS 12 and later, the AirPlay Receiver listens on 5000 and 7000, which is why Flask fails there with “address already in use”.

Should port 5000 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• On a Mac, turn off System Settings → General → AirDrop & Handoff → AirPlay Receiver, or run Flask on another port with flask run --port 5001.

Check what is listening on port 5000

sudo ss -ltnp 'sport = :5000'

sudo lsof -nP -iTCP:5000 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 5000 -State Listen
netstat -ano | findstr :5000

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 5000

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:5000 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 5000 -State Listen).OwningProcess

Allow port 5000 from trusted networks only

The examples allow 5000 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 5000 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 5000 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="5000" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "Flask / development servers 5000/TCP" -Direction Inbound -Protocol TCP -LocalPort 5000 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 5000 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 5000:5000 would expose the port to the whole network.
docker run -d -p 127.0.0.1:5000:5000 registry

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 5000 from another machine

nc -zv example.com 5000

Test-NetConnection example.com -Port 5000

Related ports

• Port 8000 (Development server (Django, Python)): a common port for development servers, including Django and Python’s http.server.
• Port 3000 (Development server / Grafana): the default port of many development servers and of Grafana.
• Port 7000 (AirPlay (macOS) / Cassandra): used by the macOS AirPlay Receiver and by Cassandra inter-node traffic.
• Port 5173 (Vite dev server): the default port of the Vite development server.

More development servers ports

4200 (Angular dev server) , 8888 (Jupyter) , 9000 (PHP-FPM / MinIO / SonarQube) , 9418 (Git protocol) . See all ports in the port lookup.

Sources

• IANA port registry (not registered for this use)

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions