系统拆解Nginx端口被占用的排查与解决方法

nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] still could not bind()

nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:8080 failed (98: Address already in use)  # 当你把 Nginx 配置为监听 8080 时

# 查看所有 nginx 相关进程（含 master + worker）
ps aux | grep nginx | grep -v grep

# 更精准：查找监听 80/443 端口的 nginx 进程（即使未完全启动）
sudo lsof -i :80 -sTCP:LISTEN 2>/dev/null | grep nginx
sudo lsof -i :443 -sTCP:LISTEN 2>/dev/null | grep nginx

sudo nginx -s stop    # 优雅停止（推荐）
# 或强制杀死
sudo pkill -f "nginx: master"

# 方法1：lsof（最直观，显示 PID、USER、COMMAND）
sudo lsof -iTCP:80 -sTCP:LISTEN -P -n 2>/dev/null

# 方法2：ss（比 netstat 更快，内核态，推荐）
sudo ss -tulnp | grep ':80\|:443\|:8080'

# 方法3：fuser（简洁，直接给出 PID）
sudo fuser -v 80/tcp
sudo fuser -v 443/tcp

sudo lsof -iTCP:80 -sTCP:LISTEN -P -n
# 或
sudo lsof -i :80 | grep LISTEN

# 查看所有 Docker 容器及其端口映射
docker ps --format "table {{.ID}}\t{{.Names}}\t{{.Status}}\t{{.Ports}}" | grep -E '(:80|:443|:8080)'

# 查看所有 active 的 systemd 服务（过滤常见 Web 服务）
systemctl list-units --type=service --state=active | grep -E '(nginx|apache|httpd|caddy|traefik|docker)'

# 查找当前用户下所有监听端口的进程（排除 root，聚焦开发环境）
lsof -iTCP:80 -sTCP:LISTEN -P -n -u $USER 2>/dev/null

# 检查是否启用
sestatus

# 临时设为 permissive 模式测试（仅测试！）
sudo setenforce 0
sudo nginx && echo "OK" || echo "Still failed"

# 恢复 enforcing
sudo setenforce 1

# 端口 < 1024 需 root 权限
# 若以普通用户运行 nginx，会报 Permission denied，而非 Address already in use
# 验证：尝试绑定 8080（非特权端口）
sudo -u nobody sh -c 'exec 3<> /dev/tcp/127.0.0.1/8080' 2>/dev/null && echo "8080 available" || echo "8080 occupied"

# 解析 /proc/net/tcp（十六进制端口需转换）
sudo awk '{print $2,$4,$10}' /proc/net/tcp | \
  awk '$1 ~ /0100007F/ && $2 ~ /00000000/ {print "Port:", strtonum("0x" substr($2,1,4)) }' | \
  sort -u

# 更实用：用 ss 直接解析（推荐）
sudo ss -tuln | head -20

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-actuator</artifactId>
    </dependency>
</dependencies>

package com.example.demo;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@SpringBootApplication
public class DemoApplication {
    public static void main(String[] args) {
        SpringApplication.run(DemoApplication.class, args);
    }
}
@RestController
class HelloController {
    @GetMapping("/api/hello")
    public String hello() {
        return "Hello from Spring Boot on port 8080!";
    }
}

server:
  port: 8080  # ⚠️ 默认即 8080，与 Nginx 常见 proxy_pass 目标冲突
management:
  endpoints:
    web:
      exposure:
        include: health, info
  endpoint:
    health:
      show-details: always

server {
    listen 80;
    server_name demo.local;

    location / {
        proxy_pass http://localhost:8080;  # ← 此处指向 Spring Boot
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    # ❌ 错误配置：同时让 Nginx 自己也监听 8080（冲突根源！）
    # listen 8080;
}

server {
    listen 80;
    listen 8080;  # ← 新增！此时 Nginx 尝试绑定 8080，但被 Spring Boot 占用
    ...
}

# application.yml
server:
  port: 8081  # 改为 8081

proxy_pass http://localhost:8081;  # 同步修改

# application.yml
server:
  port: 0  # Spring Boot 自动分配空闲端口

@RestController
public class PortController {
    @Autowired
    private Environment environment;
    @GetMapping("/actuator/port")
    public String getPort() {
        return environment.getProperty("local.server.port", "unknown");
    }
}

# application.yml
server:
  port: 0
spring:
  main:
    web-application-type: none  # 彻底禁用 Web，只跑业务逻辑

upstream springboot_backend {
    server 127.0.0.1:8081;  # 指向 Spring Boot 新端口
    # 可加健康检查
    # keepalive 32;
}

server {
    listen 80;
    server_name demo.local;

    location / {
        proxy_pass http://springboot_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

location / {
    proxy_pass http://localhost:8080;
}

# ❌ 错误：Actuator 路径未隔离，且 Nginx 自身健康检查也叫 /health
location /health {
    proxy_pass http://localhost:8080/health;  # Spring Boot 的 /actuator/health
}

# application.yml
management:
  server:
    port: 8082  # Actuator 单独监听 8082，与主应用分离！
  endpoints:
    web:
      base-path: "/manage"
      exposure:
        include: health, info, metrics, prometheus
  endpoint:
    health:
      show-details: when_authorized
  endpoints:
    web:
      cors:
        allowed-origins: "https://admin.example.com"
        allowed-methods: GET,POST

# 仅允许内网访问 Actuator
location /manage/ {
    allow 10.0.0.0/8;
    deny all;

    proxy_pass http://localhost:8082/manage/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}

# 主应用路由，排除 /manage/
location / {
    proxy_pass http://localhost:8081;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;

    # 防止客户端直接访问 Actuator
    location ~ ^/manage/ {
        return 403;
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/manage/**").authenticated() // 强制认证
                .requestMatchers("/api/**").permitAll()
                .anyRequest().authenticated()
            )
            .httpBasic(Customizer.withDefaults()); // 启用 Basic Auth
        return http.build();
    }
}

import java.io.IOException;
import java.net.ServerSocket;
import java.util.concurrent.ConcurrentHashMap;
/**
 * 动态端口分配器：确保每个服务实例获得唯一空闲端口
 */
public class DynamicPortAssigner {
    private static final ConcurrentHashMap<String, Integer> PORT_MAP = new ConcurrentHashMap<>();
    public static int assignPort(String serviceName) throws IOException {
        // 尝试 100 次，从 8081 开始
        for (int port = 8081; port <= 8180; port++) {
            try (ServerSocket socket = new ServerSocket(port)) {
                PORT_MAP.put(serviceName, port);
                System.out.println("✅ Assigned port " + port + " to " + serviceName);
                return port;
            } catch (IOException e) {
                // 端口被占用，继续下一个
                continue;
            }
        }
        throw new RuntimeException("No free port in range [8081, 8180]");
    }
    public static int getPort(String serviceName) {
        return PORT_MAP.getOrDefault(serviceName, -1);
    }
    public static void main(String[] args) throws IOException {
        // 模拟启动两个服务
        int orderPort = assignPort("order-service");
        int userPort = assignPort("user-service");
        // 输出 JSON 格式供 Nginx 动态加载（简化版）
        System.out.println("{");
        System.out.println("  \"upstreams\": [");
        System.out.println("    {\"name\": \"order-service\", \"port\": " + orderPort + "},");
        System.out.println("    {\"name\": \"user-service\", \"port\": " + userPort + "}");
        System.out.println("  ]");
        System.out.println("}");
    }
}

{
  "upstreams": [
    {"name": "order-service", "port": 8081},
    {"name": "user-service", "port": 8082}
  ]
}

# 在 http 块中定义 Lua 共享字典
lua_shared_dict dynamic_upstreams 10m;

# 使用 init_by_lua_block 加载初始 upstream
init_by_lua_block {
    local cjson = require "cjson"
    local upstreams = {
        ["order-service"] = "127.0.0.1:8081",
        ["user-service"] = "127.0.0.1:8082"
    }
    ngx.shared.dynamic_upstreams:set("upstreams", cjson.encode(upstreams))
}

# 在 location 中动态选择 upstream
location ~ ^/api/(order|user)/ {
    set $backend "";
    if ($1 = "order") {
        set $backend "order-service";
    }
    if ($1 = "user") {
        set $backend "user-service";
    }

    rewrite ^/api/([^/]+)/(.*)$ /$2 break;

    # Lua 代码获取 backend 地址
    content_by_lua_block {
        local cjson = require "cjson"
        local upstreams = ngx.shared.dynamic_upstreams:get("upstreams")
        if upstreams then
            local tbl = cjson.decode(upstreams)
            local addr = tbl[ngx.var.backend]
            if addr then
                ngx.req.set_header("Host", ngx.var.backend .. ".local")
                ngx.exec("@proxy", addr)
            else
                ngx.exit(404)
            end
        else
            ngx.exit(500)
        end
    }
}

location @proxy {
    internal;
    proxy_pass http://$args;
    proxy_set_header Host $host;
}

docker ps --format "table {{.ID}}\t{{.Names}}\t{{.Status}}\t{{.Ports}}" | grep ':80'

sudo iptables -t nat -L DOCKER -n | grep ':80'
# 输出示例：
# DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to:172.17.0.2:80

docker stop $(docker ps -q --filter "publish=80")

#!/bin/bash
# nginx-port-check.sh - 全自动 Nginx 端口占用诊断脚本
# Usage: sudo ./nginx-port-check.sh [80|443|8080]
set -euo pipefail
PORT=${1:-80}
NGINX_CONF="/etc/nginx/nginx.conf"
LOG_FILE="/var/log/nginx/port-check-$(date +%Y%m%d-%H%M%S).log"
JAVA_DETECTOR="PortDetector.java"
echo "🔍 Starting Nginx port check for port $PORT at $(date)" | tee "$LOG_FILE"
# Step 1: Check if nginx is configured to listen on this port
echo "📋 Step 1: Checking Nginx config for port $PORT..." | tee -a "$LOG_FILE"
if grep -r "listen.*$PORT" "$NGINX_CONF" /etc/nginx/conf.d/ 2>/dev/null | grep -v "#" ; then
    echo "   ✅ Found 'listen $PORT' in Nginx config" | tee -a "$LOG_FILE"
else
    echo "   ⚠️  WARNING: No 'listen $PORT' found in Nginx config. Check your conf files." | tee -a "$LOG_FILE"
fi
# Step 2: Check what's listening on $PORT
echo "🔍 Step 2: Scanning processes listening on port $PORT..." | tee -a "$LOG_FILE"
LISTENERS=$(sudo lsof -iTCP:$PORT -sTCP:LISTEN -P -n 2>/dev/null | tail -n +2 | awk '{print $1,$2,$NF}' | head -5)
if [ -z "$LISTENERS" ]; then
    echo "   ✅ Port $PORT is FREE!" | tee -a "$LOG_FILE"
    exit 0
else
    echo "   ❌ Port $PORT is occupied by:" | tee -a "$LOG_FILE"
    echo "$LISTENERS" | tee -a "$LOG_FILE"
    # Step 3: Try Java-based port scanner (more reliable than lsof in some envs)
    echo "🧪 Step 3: Running Java port detector..." | tee -a "$LOG_FILE"
    cat > "$JAVA_DETECTOR" << 'EOF'
import java.io.IOException;
import java.net.InetSocketAddress;
import java.net.Socket;
public class PortDetector {
    public static void main(String[] args) {
        if (args.length != 1) {
            System.err.println("Usage: java PortDetector <port>");
            System.exit(1);
        }
        int port = Integer.parseInt(args[0]);
        String host = "127.0.0.1";
        try (Socket socket = new Socket()) {
            socket.connect(new InetSocketAddress(host, port), 1000);
            System.out.println("✅ Port " + port + " on " + host + " is OPEN and CONNECTABLE");
        } catch (IOException e) {
            System.out.println("🔒 Port " + port + " on " + host + " is CLOSED or REFUSED");
        }
    }
}
EOF
    # Compile and run
    if command -v javac &> /dev/null; then
        javac "$JAVA_DETECTOR" 2>/dev/null && java PortDetector "$PORT" 2>/dev/null | tee -a "$LOG_FILE"
    else
        echo "   ⚠️  Java not found, skipping Java detector" | tee -a "$LOG_FILE"
    fi
fi
# Step 4: Suggest fix
echo "💡 Step 4: Suggested actions:" | tee -a "$LOG_FILE"
echo "   • To kill the occupying process: sudo kill -9 $(sudo lsof -t -i:$PORT)" | tee -a "$LOG_FILE"
echo "   • To stop Docker containers using this port: docker stop \$(docker ps -q --filter publish=$PORT)" | tee -a "$LOG_FILE"
echo "   • To change Nginx port: edit /etc/nginx/conf.d/*.conf and replace 'listen $PORT' with 'listen $(($PORT+1))'" | tee -a "$LOG_FILE"
echo "📜 Full log saved to $LOG_FILE" | tee -a "$LOG_FILE"

chmod +x nginx-port-check.sh
sudo ./nginx-port-check.sh 80

# check-nginx-ports.sh
grep "listen " /etc/nginx/conf.d/*.conf | \
  awk '{print $2}' | \
  sed 's/;//' | \
  while read port; do
    if [[ "$port" =~ ^[0-9]+$ ]] && ((port < 1024)); then
      echo "🚨 ERROR: Non-root service listening on privileged port $port"
      exit 1
    fi
  done

import org.springframework.boot.CommandLineRunner;
import org.springframework.stereotype.Component;
import java.io.IOException;
import java.net.ServerSocket;
@Component
public class PortPreCheck implements CommandLineRunner {
    private final int requiredPort;
    public PortPreCheck() {
        this.requiredPort = Integer.parseInt(System.getProperty("server.port", "8080"));
    }
    @Override
    public void run(String... args) throws Exception {
        if (isPortInUse(requiredPort)) {
            throw new RuntimeException(
                String.format("💥 FATAL: Port %d is already in use. Please stop conflicting process first.", requiredPort)
            );
        }
        System.out.printf("✅ Port %d is free. Proceeding...\n", requiredPort);
    }
    private boolean isPortInUse(int port) {
        try (ServerSocket ignored = new ServerSocket(port)) {
            return false;
        } catch (IOException e) {
            return true;
        }
    }
}

java -Dserver.port=8080 -jar app.jar