bash: line 1: netstat: command not found in an Ubuntu container means the net-tools package is not installed. Run apt-get update and apt-get install -y net-tools, or install iproute2 and use ss, which was missing too.

Neither tool was in the ubuntu:24.04 image, so there is no built-in alternative to fall back on; pick one package and install it.

The error

docker exec fix10-lc-r6 bash -c 'netstat -tlnp 2>&1; echo exit=$?; ss -tlnp 2>&1; echo exit=$?'
bash: line 1: netstat: command not found
exit=127
bash: line 1: ss: command not found
exit=127

The command went through bash -c, which is why the message carries line 1:.

Why it happens

netstat comes from the net-tools package and ss from iproute2; the image ships neither, so bash finds no program of either name and returns 127. Nothing is wrong with the container's network or with the program whose port you wanted to check.

Run apt-get update before the install in a fresh container; the fix below does both in one command.

The fix

docker exec fix10-lc-r6 bash -c 'apt-get update > /dev/null 2>&1; echo update-exit=$?; apt-get install -y net-tools > /dev/null 2>&1; echo install-exit=$?; netstat -tln 2>&1; echo exit=$?'
update-exit=0
install-exit=0
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
exit=0

docker exec fix10-lc-r6 bash -c 'apt-get install -y iproute2 > /dev/null 2>&1; echo install-exit=$?; ss -tln 2>&1; echo exit=$?'
install-exit=0
State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
exit=0

Both commands ran and printed only their header, because nothing in this test container listened on a TCP port. Either package is enough; you do not need both. Note the update ran once, before the first install; the second install in the same container needed no new update.

Which one to pick? If you follow an older guide that prints netstat output, install net-tools so your screen matches it. If you prefer the newer tool, iproute2 gave ss in the test. The two headers above show the same information in a different layout: netstat splits it into Local Address, Foreign Address and State, while ss prints State first and joins address and port as Local Address:Port. Keep the install in mind as a container-only change: in a separate test, a new container made from the same image started without the package that had been installed in the old one.

How it was reproduced

The capture was made in a container started with docker run -d --name fix10-lc-r6 ubuntu:24.04 sleep infinity (Ubuntu 24.04.5 LTS, bash 5.2.21) on Docker Engine 29.9.3, with commands sent through docker exec ... bash -c. The container name is the test's own. Every command was sent from Windows PowerShell 5.1 exactly as shown, with the -c text in single quotes so it reached the container unchanged; a single quote inside that text is written twice, as PowerShell requires.

Frequently asked

Which package provides netstat on Ubuntu?
net-tools. In the test apt-get install -y net-tools returned 0 and netstat -tln then printed its header.
Is ss installed in an Ubuntu container?
Not in ubuntu:24.04: ss printed command not found too. It comes with the iproute2 package, after which ss -tln ran.
Why does netstat show no ports in my container?
In the test nothing listened on a TCP port, so netstat -tln printed only its header. Start the program first, then check again.

More decoded errors in the Fixes category. The same net-tools package also brings back ifconfig.