Port reference
Port 2375 (TCP) – Docker Engine API (unencrypted)
Docker remote API over plain HTTP — unauthenticated control of the Docker daemon, equivalent to root on the host.
Default state
Not open by default. Becomes exposed only when an admin enables the TCP socket (-H tcp://0.0.0.0:2375) without TLS — a dangerous misconfiguration.
Common attacks
- Unauthenticated remote code execution as root on the host
- Container escape via privileged containers / host filesystem mounts
- Cryptomining deployment using the exposed daemon
- Lateral movement and persistence across the container fleet
Hardening
- Never expose 2375 — it has no authentication or encryption
- Use the local Unix socket (/var/run/docker.sock) instead of a TCP socket
- If remote access is required, use 2376 with mutual TLS (tlsverify)
- Bind only to localhost and front with an authenticated, audited proxy if needed
- Restrict by firewall/security group and keep Docker patched (e.g. CVE-2019-5736 runc)
nmap snippet
nmap -p2375 --script docker-version,http-title <target>Replace <target> with the host or range you're authorized to scan.
What runs on port 2375?
Port 2375 exposes the Docker Engine remote API over plain HTTP. The API lets clients fully control the Docker daemon — create, start, and stop containers, mount host paths, and run arbitrary commands inside them. Crucially, on 2375 there is no authentication and no encryption. The intended secure variant, port 2376, wraps the same API in mutual TLS.
Why it matters for security
The Docker daemon runs as root, and the API can mount the host filesystem and launch privileged containers. So anyone who can reach an open 2375 effectively has root-equivalent remote code execution on the host — they can read every secret, escape to the host, and pivot across the fleet. This is one of the most dangerous exposures on the internet and is routinely mass-scanned by cryptomining botnets that deploy miners within seconds of finding an open daemon.
How it's attacked
Scanners hit 2375 and confirm it with the nmap docker-version script or a
simple /version HTTP request. Once found, the attacker uses the API to run a
privileged container that mounts the host root (/), drops a payload, and gains
host root — then deploys cryptominers, steals credentials, or moves laterally.
Container-breakout bugs like the runc flaw CVE-2019-5736 can compound the
impact.
Hardening checklist
Never expose 2375. Prefer the local Unix socket
(/var/run/docker.sock) over any TCP socket. If you genuinely need remote
management, use 2376 with mutual TLS (--tlsverify), or bind to localhost
behind an authenticated, audited reverse proxy. Lock the port down with firewall
and security-group rules, run rootless Docker where feasible, and keep Docker and
runc patched. Use the nmap snippet above to detect exposed daemons on systems you
are authorized to assess.
Related ports
Frequently asked questions
- Why is port 2375 so dangerous?
- The Docker API on 2375 has no authentication or encryption. Anyone who reaches it can launch a privileged container and gain root-equivalent control of the host — full remote code execution.
- What is the difference between port 2375 and 2376?
- 2375 is the plaintext, unauthenticated Docker API and should never be exposed. 2376 is the TLS-secured variant using mutual certificate authentication for remote access.