Skip to content
ProtocolPorts

Port reference

Port 2375 (TCP) – Docker Engine API (unencrypted)

Docker remote API over plain HTTP — unauthenticated control of the Docker daemon, equivalent to root on the host.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
Critical

Actively exploited and high-impact — keep it off the public internet.

Default state

Not open by default. Becomes exposed only when an admin enables the TCP socket (-H tcp://0.0.0.0:2375) without TLS — a dangerous misconfiguration.

What is port 2375 used for?

Port 2375 exposes the Docker Engine remote API over plain, unencrypted HTTP. It lets the docker command-line client, CI pipelines, and orchestration tools control a Docker daemon remotely — creating, starting, and stopping containers and running commands inside them. The important catch is that 2375 has no authentication and no encryption; the secure equivalent is port 2376, which wraps the same API in TLS.

When would you open it?

You would only enable 2375 to manage a Docker host from another machine, and realistically you should not. Because the daemon equals root on the host, remote management should go over 2376 with mutual TLS, an SSH connection, or a socket proxy instead.

Is it safe to open?

No. Anyone who reaches an open 2375 effectively gets root on the host, which is why it is constantly scanned and abused for cryptomining. Never expose it; use the local Unix socket or 2376 with client certificates. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :2375
nmap -p 2375 <target>
Windows
netstat -ano | findstr :2375
Test-NetConnection <host> -Port 2375
macOS
lsof -i :2375
nmap -p 2375 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 2375 to your device's local IP, internal port 2375, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 2375/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=2375/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 2375 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 2375" -Direction Inbound -Protocol TCP -LocalPort 2375 -Action Allow

Security & risks

Common attacks

  • Unauthenticated remote code execution as root on the host
  • Container escape via privileged containers / host filesystem mounts
  • Cryptomining deployment using the exposed daemon
  • Lateral movement and persistence across the container fleet

CVE-2019-5736

Hardening

  • Never expose 2375 — it has no authentication or encryption
  • Use the local Unix socket (/var/run/docker.sock) instead of a TCP socket
  • If remote access is required, use 2376 with mutual TLS (tlsverify)
  • Bind only to localhost and front with an authenticated, audited proxy if needed
  • Restrict by firewall/security group and keep Docker patched (e.g. CVE-2019-5736 runc)

How to block this port

Linux (ufw)
sudo ufw deny 2375/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=2375/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 2375 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 2375" -Direction Inbound -Protocol TCP -LocalPort 2375 -Action Block

nmap snippet

nmap -p2375 --script docker-version,http-title <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 2376Port 2377Port 6443Port 10250

Frequently asked questions

Why is port 2375 so dangerous?
The Docker API on 2375 has no authentication or encryption. Anyone who reaches it can launch a privileged container and gain root-equivalent control of the host — full remote code execution.
What is the difference between port 2375 and 2376?
2375 is the plaintext, unauthenticated Docker API and should never be exposed. 2376 is the TLS-secured variant using mutual certificate authentication for remote access.

Related guides