Skip to content
ProtocolPorts

Port reference

Port 2376 (TCP) – Docker Engine API (TLS)

Docker Engine remote API over TLS — controls containers, images, and volumes on a Docker host.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Open when the Docker daemon is configured for TLS remote access; the secured counterpart of plaintext 2375.

What is port 2376 used for?

Port 2376 is the TLS-secured Docker Engine remote API — the encrypted, properly authenticated counterpart of plaintext port 2375. It lets a remote client such as the docker command-line tool, CI systems, or orchestration tools manage containers, images, volumes, and networks on a Docker host. Configured correctly, it requires mutual TLS so only clients holding a valid certificate can connect.

When would you open it?

You open 2376 when you genuinely need to manage a Docker host remotely and have set up TLS certificates for it. Restrict it to your trusted management machines or admin network rather than the open internet, since the API is powerful.

Is it safe to open?

It can be, but only if client-certificate verification (--tlsverify) is actually enforced; without it, the daemon is as exposed as plaintext 2375 and gives root on the host. Require mutual TLS, keep it off the public internet, and limit it to trusted IPs. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :2376
nmap -p 2376 <target>
Windows
netstat -ano | findstr :2376
Test-NetConnection <host> -Port 2376
macOS
lsof -i :2376
nmap -p 2376 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 2376 to your device's local IP, internal port 2376, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 2376/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=2376/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 2376 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 2376" -Direction Inbound -Protocol TCP -LocalPort 2376 -Action Allow

Security & risks

Common attacks

  • Abuse of misconfigured TLS without client-certificate auth
  • Container escape to host via privileged/bind-mount runs
  • Image and secret theft through the remote API
  • Cryptojacking by launching attacker containers

Hardening

  • Require mutual TLS (verify client certificates, tlsverify)
  • Never expose the Docker API to the internet
  • Restrict access to trusted management hosts and IPs
  • Rotate and protect CA/server/client certificates
  • Prefer SSH or a socket proxy over a raw TCP API

How to block this port

Linux (ufw)
sudo ufw deny 2376/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=2376/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 2376 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 2376" -Direction Inbound -Protocol TCP -LocalPort 2376 -Action Block

nmap snippet

nmap -p2376 --script ssl-cert <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 2375Port 2377Port 6443Port 22

Frequently asked questions

How is port 2376 different from 2375?
2375 is the plaintext, unauthenticated Docker API — extremely dangerous if exposed. 2376 is the TLS port and is meant to require client-certificate authentication, but only if tlsverify is configured.
Why does an exposed Docker API mean host compromise?
The API can launch a privileged container that bind-mounts the host filesystem, giving root on the host. Anyone who can call the API effectively owns the machine.

Related guides