What’s running on port 27017 on my Mac?

Check what’s on port 27017

lsof -nP -iTCP:27017 -sTCP:LISTEN
ps -o pid,command -p <PID>

A mongod with a path under /opt/homebrew is the Homebrew service (brew services list confirms it). com.docker.backend or OrbStack means a container: docker ps --filter publish=27017 shows which.

You can also ask the server directly:

mongosh --quiet --eval 'db.serverStatus().host + " " + db.version()'

With Stat Space: statspace port 27017.

Stop it cleanly

Don’t kill -9 a database. Use:

Install	Stop
Homebrew	brew services stop mongodb-community
Docker	docker stop <name>
Started by hand	mongosh admin --eval 'db.shutdownServer()'

Plain kill <PID> (SIGTERM) is also a clean shutdown for mongod.

Change the port

In /opt/homebrew/etc/mongod.conf:

net:
  port: 27018
  bindIp: 127.0.0.1

Then brew services restart mongodb-community. For Docker, change the host side only: -p 127.0.0.1:27018:27017. Update your connection string, for example mongodb://localhost:27018/app.

Security: never expose 27017

MongoDB has had access control off by default for years, and exposed instances are a classic target: bots find them, copy or delete the data and leave a ransom note.

• Since MongoDB 3.6, mongod binds to localhost unless told otherwise, and Homebrew’s config sets bindIp: 127.0.0.1. Keep it.
• The Docker mongo image listens on all addresses inside the container, and -p 27017:27017 publishes it on all of your Mac’s interfaces. Use -p 127.0.0.1:27017:27017, and set MONGO_INITDB_ROOT_USERNAME / MONGO_INITDB_ROOT_PASSWORD to turn on auth.
• mongo-express on 8081 is an admin panel for the same data. Keep it local too.

Check with lsof: you want 127.0.0.1:27017. See dev server exposed to the network.

Seeing it live

Stat Space lists 27017 with the process behind it and warns if it’s on *:27017. With Pro, a Docker MongoDB shows its container and image name instead of com.docker.backend.