Port 9000: PHP-FPM / Portainer / MinIO
Port 9000 is a busy default used by PHP-FPM, Portainer, MinIO, SonarQube and others.
What runs on port 9000
PHP-FPM, which runs PHP behind web servers like nginx, listens on TCP 9000 for FastCGI requests. Older Portainer versions serve their Docker management interface over HTTP on 9000, MinIO's storage API defaults to 9000, and SonarQube's web interface does too. What 9000 means depends entirely on the machine.
On a home network
Home servers and NAS boxes running Docker often have Portainer or MinIO on 9000. Consumer devices do not use it.
If port 9000 is reachable from the internet
Each of these is dangerous on the internet in its own way. An exposed PHP-FPM port can let an attacker run code on the server, Portainer controls every container on the host, and MinIO holds your files behind its access keys. Keep 9000 internal and put anything that must be remote behind HTTPS and a login.
How to check whether it is open on your network
Find out what is listening with a LAN port scan and on the host itself, then check whether a Docker container publishes 9000 on all interfaces or your router forwards it.
To find out whether port 9000 is open on something in your home, and whether the internet can reach it, the app scans your Wi-Fi from your phone and checks your public address from the outside. It says what it checked and what it could not. Get RECON for iPhone — one-time purchase, no account, nothing leaves the device.