What is using port 27017 on my Mac?

Port 27017 is the default for MongoDB. A listener means a local MongoDB server is running, usually started by Homebrew or Docker. Run lsof -i :27017 to confirm.

Is it safe to kill the process on port 27017?

It stops your local MongoDB server, which is safe for macOS. Stop it gracefully with brew services stop mongodb-community or by stopping the container, rather than force-killing it, so the database closes cleanly.

Should port 27017 be exposed to the internet?

No. MongoDB should listen on localhost only. Exposed 27017 instances have been the source of major data breaches and are a constant scan target.

Port 27017: What's Using It and Is It Safe to Kill?

Port 27017 is the default port for MongoDB. If it’s in use on your Mac, you have a MongoDB server running, almost always a local one for development.

What typically listens on port 27017

MongoDB: The default mongod server port. Homebrew’s mongodb-community formula and Docker images use it.
Docker and dev environments: Containers map MongoDB to 27017 on the host.

A local MongoDB install binds to 127.0.0.1 by default, so it’s reachable from your Mac but not the network. Docker is the exception: the official image listens on all interfaces inside the container, so what matters is how you publish the port. Map it to 127.0.0.1 if you don’t want it exposed.

Is it safe to kill?

Stopping it won’t hurt macOS, but a database deserves a clean shutdown rather than a force-kill. Stop it properly:

brew services stop mongodb-community

Or stop the container if you run it in Docker. Only kill the PID if mongod is genuinely hung.

Is it suspicious?

On a machine where you do database work, no. Worth checking: that MongoDB is bound to localhost only. Exposed MongoDB instances have caused some of the largest data breaches on record, so a 27017 listener reachable from outside your machine is a serious problem.

How to find what’s on port 27017 on macOS

lsof -i :27017

To stop a stuck process by PID:

kill $(lsof -ti :27017)

Portie shows port 27017 alongside the mongod process in its live view, so you can confirm whether your database is running and which install owns it.