ss: Usage, Options & Common CI Errors

ss lists sockets - which ports are listening and which connections are open.

ss is the go-to for confirming a service is actually listening before tests connect to it. It is faster than netstat and ships in iproute2, but it is still missing from many slim container images.

What it does

ss dumps socket statistics from the kernel - listening sockets, established connections, and their owning processes. In CI it answers the question "did my service bind the port yet?" before a test or health check runs.

Common usage

Terminal

ss -tlnp                       # TCP, listening, numeric, with PID
ss -tuln                       # TCP + UDP listening, numeric
ss -t state established        # established TCP connections
ss -tln sport = :8080          # is anything listening on 8080?
ss -tln 'sport = :8080' | grep -q LISTEN && echo up

Options

Flag	What it does
-t / -u	TCP / UDP sockets
-l	Only listening sockets
-n	Numeric - do not resolve ports/hosts (faster)
-p	Show the owning process (needs privilege)
-a	All sockets (listening and non-listening)
sport = :N	Filter by source port

Common errors in CI

ss: command not found - iproute2 is absent on Alpine/distroless; apk add iproute2 or apt-get install -y iproute2, or fall back to /proc/net/tcp. -p shows no process name without privilege ("users:..." is empty) - run as root or in a privileged step. A common readiness pattern is a poll loop that runs ss -tln with a sport = :8080 filter, grep -q LISTEN, and sleeps between tries. Remember ss only sees sockets in its own network namespace, so it cannot see ports inside a separate container unless you share the namespace.