Calculator

Port conflict checker

Pick your services or paste a compose ports block, and see which host ports two things are both trying to claim.

Last reviewed 8 September 2026Runs entirely in your browser

Select the services you run, or paste a ports: block straight out of a compose file, and this maps every host port the set wants to claim. Collisions are flagged with a suggested free port, ports below 1024 are marked as needing root or a proxy, and the ports people recognize get a note saying what normally lives there.

It exists because port collisions are not rare bad luck, they are the default outcome. Nineteen of the 105 catalogued tools ship 8080 as their default, eleven ship 3000, and six ship 9000. Two of those in one stack and the second docker compose up fails with a message that names the port but not the owner.

Paste mode reads the left side of each mapping, so you can drop in an entire block including quoted entries and comments, and it will only pick up host ports.

Nothing you paste is uploaded. The port table and the whole app dataset are in the page already, and the matching happens in your browser.

1. Pick what you want to run

Or paste ports you already use

One per line, or a whole docker compose ports block. Host ports are read from the left side of each mapping.

How it works#

Each service contributes the ports listed in its profile as default_ports, which are the ports the project itself ships in its reference compose file or documentation. Pasted text is scanned line by line: anything matching <digits>:<digits> contributes the left number, and a bare number on its own line is taken as a host port.

A port claimed by two or more entries is a collision. The suggested replacement is the next number above it that nothing else in your set has claimed, which is deliberately dull: 8081:8080 is easier to remember six months later than a random high port. Ports below 1024 get a separate note, because those fail differently: not a collision but a permission error, and under a rootless engine they fail even when nothing else is listening.

What it deliberately does not model#

Your actual machine. This compares documented defaults against each other. It cannot see that you already have something on 8096, or that your NAS web UI owns 443. Confirm with ss -tulpn on the host before you commit.
Configured ports. Almost every one of these can be moved by an environment variable or a config file, and many people already have. The map is what happens if you accept every default.
Protocol and interface. TCP 53 and UDP 53 are different bindings, and 127.0.0.1:8080 does not conflict with 192.168.1.5:8080. The checker treats a port number as a single claim, which is the conservative answer.
Internal ports. Container-to-container traffic is not in scope, and databases in a stack should not be published at all.
Firewall rules. A free port is not an open one, and an open one is not one you meant to expose.

What to do with the answer#

For each collision, change the host side of the mapping only. 8081:8080 leaves the image untouched, because the process inside still listens where it always did. Restart that one service, update the bookmark and move on.

Then do the thing that makes the problem stop recurring: put a reverse proxy in front and delete the ports: blocks. Services join an internal network, the proxy addresses them by container name, and only 80 and 443 are published on the host. The Reverse proxy generator emits the configuration for Caddy, Traefik, nginx or Nginx Proxy Manager from the same list of services, and Reverse proxy and TLS covers the certificates. If you are still choosing what to run, the Stack planner flags the same collisions alongside the memory arithmetic.

Questions#

What port does Immich use?

Since the server and machine learning containers were consolidated behind one entry point, Immich publishes a single HTTP port and the compose file maps 2283:2283. Postgres and the Valkey cache stay on the internal network and should not be published at all. If a guide has you publishing the Postgres or Valkey ports alongside it, delete those lines: exposing the Immich database to your LAN gains you nothing and costs you a boundary.

Why does Docker say 'port is already allocated'?

Something else on the host is already listening. The full message looks like Bind for 0.0.0.0:8080 failed: port is already allocated. Find the owner with ss -tulpn | grep :8080 for host processes, and docker ps --format '{{.Names}} {{.Ports}}' for containers, including stopped-but-not-removed ones from a previous compose project. If nothing shows up, a container from an old project name may still hold it: docker ps -a and remove it.

Can two containers use the same port?

Inside their own networks, yes, always: every container has its own IP, so ten containers can all listen on 8080 internally without noticing each other. The conflict only exists when you publish to the host. You can also bind the same port on different host addresses, for example 127.0.0.1:8080:8080 for one and 192.168.1.5:8080:8080 for another, which is a legitimate trick for keeping an admin UI on localhost only.

Which ports need root?

Everything below 1024. On a normal Docker install the daemon runs as root so it can bind them for you, which is why publishing 80 works without you thinking about it. Under rootless Docker or Podman it fails until you either lower net.ipv4.ip_unprivileged_port_start, grant CAP_NET_BIND_SERVICE, or publish a high port and let something else forward. In practice exactly one thing should own 80 and 443, and that thing is your reverse proxy.

Do I still need to publish ports if I use a reverse proxy?

No, and you should stop. Put the services and the proxy on a shared Docker network, drop the ports: block entirely, and the proxy reaches the container by name on its internal port: reverse_proxy jellyfin:8096. Nothing is listening on your LAN except the proxy, so collisions become impossible and a mistyped firewall rule stops mattering. Keep a published port only for things a HTTP proxy cannot carry, such as DNS on 53 or a WireGuard endpoint on 51820.

Which default port is contested most?

8080, by a wide margin: 19 of the catalogued tools use it, including code-server, Open WebUI, SearXNG, Trilium Notes and the Traefik dashboard. Port 3000 is next with 11, and 9000 has six. If you are choosing a fixed convention, give 8080 to nothing and assign host ports in a range you own, such as 8100 upward, so that the next service you install never collides with the last.

Published 7 September 2026. Last reviewed 7 September 2026. Found something out of date? Tell us and we will fix it and log the change.