lsof Command Reference: Flags, Usage & CI Examples

lsof lists open files, including network sockets, per process.

lsof reports open files, and because sockets are files it also answers "which process is using this port". In CI it diagnoses port conflicts and leaked file handles.

Common flags and usage

• -i [:port]: network sockets, optionally for a port
• -P: numeric ports (no service-name lookup)
• -n: numeric addresses (no DNS)
• -p <pid>: files held by a process
• -t: terse output, just PIDs (good for piping to kill)
• +D <dir>: files open under a directory

Example

lsof -i :3000 -P -n || echo "nothing on port 3000"

In CI

When a step fails with "address already in use", lsof -i :PORT -P -n shows the offending process so you can kill it: kill "$(lsof -t -i :3000)". lsof is sometimes absent on slim images; ss -tlnp can stand in for the socket case.

Key takeaways

• lsof -i shows which process holds a network port.
• lsof -t emits bare PIDs to pipe into kill.
• ss -tlnp can substitute when lsof is unavailable.

Related guides