The dev server for my site came up on port 3001 for months. Next.js wants 3000, finds it taken, moves up one, and says nothing worth reading. When I finally asked who had 3000, this is what ss told me as a normal user. It is the opening run of the open-ports guide on the site, published 2026-09-01:

$ ss -ltnp 'sport = :3000' State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 4096 0.0.0.0:3000 0.0.0.0:* LISTEN 0 4096 [::]:3000 [::]:*

Enter fullscreen mode

Exit fullscreen mode

Two sockets, every IPv4 interface and every IPv6 interface, and an empty Process column. One more flag, ss -ltnpe , printed the socket's cgroup, cgroup:/system.slice/docker.service , and one docker ps later the owner had a name: a docker-proxy publishing an Open WebUI container's port 8080 as host port 3000. It had been there since spring.

The container is not the part that bothers me. I had read output like that before, seen no name, and moved on. Both answers were on screen.…