系统拆解Nginx端口被占用的排查与解决方法

nginx: [emerg] bind() to 0.0.0.0:80 failed (98: address already in use)
nginx: [emerg] still could not bind()

nginx: [emerg] bind() to [::]:443 failed (98: address already in use)
nginx: [emerg] bind() to 0.0.0.0:8080 failed (98: address already in use)  # 当你把 nginx 配置为监听 8080 时

# 查看所有 nginx 相关进程（含 master + worker）
ps aux | grep nginx | grep -v grep

# 更精准：查找监听 80/443 端口的 nginx 进程（即使未完全启动）
sudo lsof -i :80 -stcp:listen 2>/dev/null | grep nginx
sudo lsof -i :443 -stcp:listen 2>/dev/null | grep nginx

sudo nginx -s stop    # 优雅停止（推荐）
# 或强制杀死
sudo pkill -f "nginx: master"

# 方法1：lsof（最直观，显示 pid、user、command）
sudo lsof -itcp:80 -stcp:listen -p -n 2>/dev/null

# 方法2：ss（比 netstat 更快，内核态，推荐）
sudo ss -tulnp | grep ':80\|:443\|:8080'

# 方法3：fuser（简洁，直接给出 pid）
sudo fuser -v 80/tcp
sudo fuser -v 443/tcp

sudo lsof -itcp:80 -stcp:listen -p -n
# 或
sudo lsof -i :80 | grep listen

# 查看所有 docker 容器及其端口映射
docker ps --format "table {{.id}}\t{{.names}}\t{{.status}}\t{{.ports}}" | grep -e '(:80|:443|:8080)'

# 查看所有 active 的 systemd 服务（过滤常见 web 服务）
systemctl list-units --type=service --state=active | grep -e '(nginx|apache|httpd|caddy|traefik|docker)'

# 查找当前用户下所有监听端口的进程（排除 root，聚焦开发环境）
lsof -itcp:80 -stcp:listen -p -n -u $user 2>/dev/null

# 检查是否启用
sestatus

# 临时设为 permissive 模式测试（仅测试！）
sudo setenforce 0
sudo nginx && echo "ok" || echo "still failed"

# 恢复 enforcing
sudo setenforce 1

# 端口 < 1024 需 root 权限
# 若以普通用户运行 nginx，会报 permission denied，而非 address already in use
# 验证：尝试绑定 8080（非特权端口）
sudo -u nobody sh -c 'exec 3<> /dev/tcp/127.0.0.1/8080' 2>/dev/null && echo "8080 available" || echo "8080 occupied"

# 解析 /proc/net/tcp（十六进制端口需转换）
sudo awk '{print $2,$4,$10}' /proc/net/tcp | \
  awk '$1 ~ /0100007f/ && $2 ~ /00000000/ {print "port:", strtonum("0x" substr($2,1,4)) }' | \
  sort -u

# 更实用：用 ss 直接解析（推荐）
sudo ss -tuln | head -20

<dependencies>
    <dependency>
        <groupid>org.springframework.boot</groupid>
        <artifactid>spring-boot-starter-web</artifactid>
    </dependency>
    <dependency>
        <groupid>org.springframework.boot</groupid>
        <artifactid>spring-boot-starter-actuator</artifactid>
    </dependency>
</dependencies>

package com.example.demo;
import org.springframework.boot.springapplication;
import org.springframework.boot.autoconfigure.springbootapplication;
import org.springframework.web.bind.annotation.getmapping;
import org.springframework.web.bind.annotation.restcontroller;
@springbootapplication
public class demoapplication {
    public static void main(string[] args) {
        springapplication.run(demoapplication.class, args);
    }
}
@restcontroller
class hellocontroller {
    @getmapping("/api/hello")
    public string hello() {
        return "hello from spring boot on port 8080!";
    }
}

server:
  port: 8080  # ⚠️ 默认即 8080，与 nginx 常见 proxy_pass 目标冲突
management:
  endpoints:
    web:
      exposure:
        include: health, info
  endpoint:
    health:
      show-details: always

server {
    listen 80;
    server_name demo.local;

    location / {
        proxy_pass http://localhost:8080;  # ← 此处指向 spring boot
        proxy_set_header host $host;
        proxy_set_header x-real-ip $remote_addr;
    }

    # ❌ 错误配置：同时让 nginx 自己也监听 8080（冲突根源！）
    # listen 8080;
}

server {
    listen 80;
    listen 8080;  # ← 新增！此时 nginx 尝试绑定 8080，但被 spring boot 占用
    ...
}

# application.yml
server:
  port: 8081  # 改为 8081

proxy_pass http://localhost:8081;  # 同步修改

# application.yml
server:
  port: 0  # spring boot 自动分配空闲端口

@restcontroller
public class portcontroller {
    @autowired
    private environment environment;
    @getmapping("/actuator/port")
    public string getport() {
        return environment.getproperty("local.server.port", "unknown");
    }
}

# application.yml
server:
  port: 0
spring:
  main:
    web-application-type: none  # 彻底禁用 web，只跑业务逻辑

upstream springboot_backend {
    server 127.0.0.1:8081;  # 指向 spring boot 新端口
    # 可加健康检查
    # keepalive 32;
}

server {
    listen 80;
    server_name demo.local;

    location / {
        proxy_pass http://springboot_backend;
        proxy_set_header host $host;
        proxy_set_header x-real-ip $remote_addr;
    }
}

location / {
    proxy_pass http://localhost:8080;
}

# ❌ 错误：actuator 路径未隔离，且 nginx 自身健康检查也叫 /health
location /health {
    proxy_pass http://localhost:8080/health;  # spring boot 的 /actuator/health
}

# application.yml
management:
  server:
    port: 8082  # actuator 单独监听 8082，与主应用分离！
  endpoints:
    web:
      base-path: "/manage"
      exposure:
        include: health, info, metrics, prometheus
  endpoint:
    health:
      show-details: when_authorized
  endpoints:
    web:
      cors:
        allowed-origins: "https://admin.example.com"
        allowed-methods: get,post

# 仅允许内网访问 actuator
location /manage/ {
    allow 10.0.0.0/8;
    deny all;

    proxy_pass http://localhost:8082/manage/;
    proxy_set_header host $host;
    proxy_set_header x-real-ip $remote_addr;
}

# 主应用路由，排除 /manage/
location / {
    proxy_pass http://localhost:8081;
    proxy_set_header host $host;
    proxy_set_header x-real-ip $remote_addr;

    # 防止客户端直接访问 actuator
    location ~ ^/manage/ {
        return 403;
    }
}

@configuration
@enablewebsecurity
public class securityconfig {
    @bean
    public securityfilterchain filterchain(httpsecurity http) throws exception {
        http
            .authorizehttprequests(authz -> authz
                .requestmatchers("/manage/**").authenticated() // 强制认证
                .requestmatchers("/api/**").permitall()
                .anyrequest().authenticated()
            )
            .httpbasic(customizer.withdefaults()); // 启用 basic auth
        return http.build();
    }
}

import java.io.ioexception;
import java.net.serversocket;
import java.util.concurrent.concurrenthashmap;
/**
 * 动态端口分配器：确保每个服务实例获得唯一空闲端口
 */
public class dynamicportassigner {
    private static final concurrenthashmap<string, integer> port_map = new concurrenthashmap<>();
    public static int assignport(string servicename) throws ioexception {
        // 尝试 100 次，从 8081 开始
        for (int port = 8081; port <= 8180; port++) {
            try (serversocket socket = new serversocket(port)) {
                port_map.put(servicename, port);
                system.out.println("✅ assigned port " + port + " to " + servicename);
                return port;
            } catch (ioexception e) {
                // 端口被占用，继续下一个
                continue;
            }
        }
        throw new runtimeexception("no free port in range [8081, 8180]");
    }
    public static int getport(string servicename) {
        return port_map.getordefault(servicename, -1);
    }
    public static void main(string[] args) throws ioexception {
        // 模拟启动两个服务
        int orderport = assignport("order-service");
        int userport = assignport("user-service");
        // 输出 json 格式供 nginx 动态加载（简化版）
        system.out.println("{");
        system.out.println("  \"upstreams\": [");
        system.out.println("    {\"name\": \"order-service\", \"port\": " + orderport + "},");
        system.out.println("    {\"name\": \"user-service\", \"port\": " + userport + "}");
        system.out.println("  ]");
        system.out.println("}");
    }
}

{
  "upstreams": [
    {"name": "order-service", "port": 8081},
    {"name": "user-service", "port": 8082}
  ]
}

# 在 http 块中定义 lua 共享字典
lua_shared_dict dynamic_upstreams 10m;

# 使用 init_by_lua_block 加载初始 upstream
init_by_lua_block {
    local cjson = require "cjson"
    local upstreams = {
        ["order-service"] = "127.0.0.1:8081",
        ["user-service"] = "127.0.0.1:8082"
    }
    ngx.shared.dynamic_upstreams:set("upstreams", cjson.encode(upstreams))
}

# 在 location 中动态选择 upstream
location ~ ^/api/(order|user)/ {
    set $backend "";
    if ($1 = "order") {
        set $backend "order-service";
    }
    if ($1 = "user") {
        set $backend "user-service";
    }

    rewrite ^/api/([^/]+)/(.*)$ /$2 break;

    # lua 代码获取 backend 地址
    content_by_lua_block {
        local cjson = require "cjson"
        local upstreams = ngx.shared.dynamic_upstreams:get("upstreams")
        if upstreams then
            local tbl = cjson.decode(upstreams)
            local addr = tbl[ngx.var.backend]
            if addr then
                ngx.req.set_header("host", ngx.var.backend .. ".local")
                ngx.exec("@proxy", addr)
            else
                ngx.exit(404)
            end
        else
            ngx.exit(500)
        end
    }
}

location @proxy {
    internal;
    proxy_pass http://$args;
    proxy_set_header host $host;
}

docker ps --format "table {{.id}}\t{{.names}}\t{{.status}}\t{{.ports}}" | grep ':80'

sudo iptables -t nat -l docker -n | grep ':80'
# 输出示例：
# dnat       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to:172.17.0.2:80

docker stop $(docker ps -q --filter "publish=80")

#!/bin/bash
# nginx-port-check.sh - 全自动 nginx 端口占用诊断脚本
# usage: sudo ./nginx-port-check.sh [80|443|8080]
set -euo pipefail
port=${1:-80}
nginx_conf="/etc/nginx/nginx.conf"
log_file="/var/log/nginx/port-check-$(date +%y%m%d-%h%m%s).log"
java_detector="portdetector.java"
echo "🔍 starting nginx port check for port $port at $(date)" | tee "$log_file"
# step 1: check if nginx is configured to listen on this port
echo "📋 step 1: checking nginx config for port $port..." | tee -a "$log_file"
if grep -r "listen.*$port" "$nginx_conf" /etc/nginx/conf.d/ 2>/dev/null | grep -v "#" ; then
    echo "   ✅ found 'listen $port' in nginx config" | tee -a "$log_file"
else
    echo "   ⚠️  warning: no 'listen $port' found in nginx config. check your conf files." | tee -a "$log_file"
fi
# step 2: check what's listening on $port
echo "🔍 step 2: scanning processes listening on port $port..." | tee -a "$log_file"
listeners=$(sudo lsof -itcp:$port -stcp:listen -p -n 2>/dev/null | tail -n +2 | awk '{print $1,$2,$nf}' | head -5)
if [ -z "$listeners" ]; then
    echo "   ✅ port $port is free!" | tee -a "$log_file"
    exit 0
else
    echo "   ❌ port $port is occupied by:" | tee -a "$log_file"
    echo "$listeners" | tee -a "$log_file"
    # step 3: try java-based port scanner (more reliable than lsof in some envs)
    echo "🧪 step 3: running java port detector..." | tee -a "$log_file"
    cat > "$java_detector" << 'eof'
import java.io.ioexception;
import java.net.inetsocketaddress;
import java.net.socket;
public class portdetector {
    public static void main(string[] args) {
        if (args.length != 1) {
            system.err.println("usage: java portdetector <port>");
            system.exit(1);
        }
        int port = integer.parseint(args[0]);
        string host = "127.0.0.1";
        try (socket socket = new socket()) {
            socket.connect(new inetsocketaddress(host, port), 1000);
            system.out.println("✅ port " + port + " on " + host + " is open and connectable");
        } catch (ioexception e) {
            system.out.println("🔒 port " + port + " on " + host + " is closed or refused");
        }
    }
}
eof
    # compile and run
    if command -v javac &> /dev/null; then
        javac "$java_detector" 2>/dev/null && java portdetector "$port" 2>/dev/null | tee -a "$log_file"
    else
        echo "   ⚠️  java not found, skipping java detector" | tee -a "$log_file"
    fi
fi
# step 4: suggest fix
echo "💡 step 4: suggested actions:" | tee -a "$log_file"
echo "   • to kill the occupying process: sudo kill -9 $(sudo lsof -t -i:$port)" | tee -a "$log_file"
echo "   • to stop docker containers using this port: docker stop \$(docker ps -q --filter publish=$port)" | tee -a "$log_file"
echo "   • to change nginx port: edit /etc/nginx/conf.d/*.conf and replace 'listen $port' with 'listen $(($port+1))'" | tee -a "$log_file"
echo "📜 full log saved to $log_file" | tee -a "$log_file"

chmod +x nginx-port-check.sh
sudo ./nginx-port-check.sh 80

# check-nginx-ports.sh
grep "listen " /etc/nginx/conf.d/*.conf | \
  awk '{print $2}' | \
  sed 's/;//' | \
  while read port; do
    if [[ "$port" =~ ^[0-9]+$ ]] && ((port < 1024)); then
      echo "🚨 error: non-root service listening on privileged port $port"
      exit 1
    fi
  done

import org.springframework.boot.commandlinerunner;
import org.springframework.stereotype.component;
import java.io.ioexception;
import java.net.serversocket;
@component
public class portprecheck implements commandlinerunner {
    private final int requiredport;
    public portprecheck() {
        this.requiredport = integer.parseint(system.getproperty("server.port", "8080"));
    }
    @override
    public void run(string... args) throws exception {
        if (isportinuse(requiredport)) {
            throw new runtimeexception(
                string.format("💥 fatal: port %d is already in use. please stop conflicting process first.", requiredport)
            );
        }
        system.out.printf("✅ port %d is free. proceeding...\n", requiredport);
    }
    private boolean isportinuse(int port) {
        try (serversocket ignored = new serversocket(port)) {
            return false;
        } catch (ioexception e) {
            return true;
        }
    }
}

java -dserver.port=8080 -jar app.jar