Read the failure by layer
| Observation | Layer that worked | Investigate next |
|---|---|---|
ERR_CONNECTION_REFUSED | DNS/hosts may resolve, but no TCP connection completed. | Process state, bind address, port, container publishing. |
| HTTP 404 | Network and web server both responded. | Context path, controller/servlet mapping, requested URL. |
| HTTP 401 or 403 | The application received the request. | Authentication, authorization, CSRF, or proxy headers. |
| HTTP 502 from a proxy | The proxy is reachable. | Proxy upstream address, protocol, and backend health. |
| Wrong application page | A service is listening, but not the intended one. | Identify the process that owns 8080. |
Identify the owner of port 8080
# Windows PowerShell
Get-NetTCPConnection -LocalPort 8080 -State Listen |
Select-Object LocalAddress, OwningProcess
Get-Process -Id <PID>
# macOS or Linux
lsof -nP -iTCP:8080 -sTCP:LISTEN
# Check the HTTP response
curl -i http://127.0.0.1:8080/Keep the application log open while requesting the URL. If no request appears in the intended app’s log, the request is reaching another process or never reaching 8080 at all.
Spring Boot on 8080
A standalone Spring Boot web application uses 8080 by default. Change it explicitly when projects collide:
# application.properties
server.port=8081
# or application.yaml
server:
port: 8081
# one run only
java -jar app.jar --server.port=8081A 404 at / does not mean Spring Boot failed to start. It can mean the application has no handler for the root path. Test a route the application actually exposes. If Actuator is installed and deliberately exposed, its default base path is commonly /actuator; do not assume every endpoint is public.
Context path: when server.servlet.context-path=/app, a controller mapped to /health is reached at http://localhost:8080/app/health, not /health.
Tomcat and reverse proxies
For an external Tomcat installation, check the HTTP connector in conf/server.xml and the application’s deployed context. For Nginx, Caddy, or another reverse proxy, separate the two hops:
- Request the backend directly at
http://127.0.0.1:8080. - Confirm the proxy’s upstream uses the same protocol and port.
- Then request the public proxy URL and compare response headers and logs.
If the backend expects HTTP but the proxy tries HTTPS, a port can be open while the request still fails during protocol negotiation.
Docker and remote access
# Publish host port 8080 to container port 8080
docker run --rm -p 8080:8080 your-image
# Confirm the published mapping
docker ps --format "table {{.Names}}\t{{.Ports}}"The process inside the container must listen on an address reachable from the container network, usually 0.0.0.0, not only its internal 127.0.0.1. Publishing a port cannot make a loopback-only process reachable from outside its container.
Do not expose development admin consoles publicly. Limit bindings and firewall rules to the smallest network that needs access.
GeoServer on 8080
GeoServer is often deployed under a web-application context, so the expected URL may be http://localhost:8080/geoserver rather than the root. A Tomcat page at / and a working GeoServer page at /geoserver are consistent with a normal context deployment.
For account access and data-directory checks, use the focused GeoServer localhost guide.
Official references
- Spring Boot: Embedded web serversDefault HTTP port and supported ways to change it.
- Spring Boot: Monitoring over HTTPActuator base path and management-server port behavior.
- Apache Tomcat: HTTP ConnectorConnector addresses, ports, proxy settings, and protocol configuration.
- Docker: Publishing portsHost-to-container port mappings.