What port 5000 is
TCP port 5000 has no single official service. Several popular tools use it by default, so on a developer machine it is frequently busy before your app starts. It carries plain HTTP unless the software adds TLS.
| Software | What listens on 5000 |
|---|---|
Flask (flask run) |
The development server |
Docker Registry (registry:2 image) |
The registry API |
| macOS 12 Monterey and later | AirPlay Receiver (process ControlCenter) |
| Older ASP.NET Core templates | Kestrel over HTTP (5001 for HTTPS) |
| Synology DSM | The web interface over HTTP (5001 for HTTPS) |
"Port 5000 is already in use" on a Mac
On macOS 12 and later, the AirPlay Receiver listens on ports 5000 and 7000. Flask then fails with Address already in use, or a request to localhost:5000 returns 403 Forbidden with a Server: AirTunes header. Check:
lsof -i :5000
If the command is ControlCenter, either turn off AirPlay Receiver in System Settings (General, AirDrop & Handoff) or run your app on another port:
flask run --port 5001
Finding other processes
On Linux:
sudo ss -tlnp 'sport = :5000'
sudo lsof -i :5000
On Windows:
netstat -ano | findstr :5000
taskkill /PID 12345 /F
A forgotten dev server, a crashed process or a Docker container (docker ps shows 0.0.0.0:5000->5000/tcp) are the usual causes. Stop it, or pick another port.
Should it be open to the internet?
Not as a development server. Flask's built-in server is meant for development only, and debug mode exposes an interactive debugger that can run code; never run flask run --debug on a public address. In production, serve the app with a WSGI server such as Gunicorn on loopback, behind nginx on 80 and 443:
gunicorn --bind 127.0.0.1:5000 app:app
location / {
proxy_pass http://127.0.0.1:5000;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
}
A Docker Registry on 5000 should not be public without authentication and TLS. Put it behind a proxy with HTTPS and basic auth or token auth, or keep it on a private network. A Synology NAS is safer reached through a VPN than with 5000 and 5001 forwarded on the router.
Firewall rules
sudo ufw allow from 192.0.2.0/24 to any port 5000 proto tcp
sudo ufw deny 5000/tcp
ufw applies the first matching rule, so the allow must come before the deny. Leave out the allow line to block the port for everyone.
With Docker, publish on loopback (-p 127.0.0.1:5000:5000); published ports bypass ufw on most Linux hosts.
How to test it
nc -zv app.example.com 5000
curl -I http://app.example.com:5000/
Our Port Scanner does not probe port 5000, so use these commands from a machine outside your network to confirm it is closed.
Related ports
- Port 3000: Node.js, Next.js and Rails dev servers.
- Port 8080: the classic alternative HTTP port.
- Port 443: where the public site belongs.
Once the app is behind a proxy, confirm what the public URL returns with the HTTP Status Checker.