Port 2375 – Docker Daemon (unencrypted)

TCP

Port 2375 is the Docker daemon's unencrypted REST API port. When exposed, any client can control the entire Docker host – pull images, run containers, mount host filesystems, and achieve full root-equivalent code execution. Port 2375 must never be exposed to any network. Use Unix socket (/var/run/docker.sock) locally, or TLS-protected port 2376 for remote access.

Port Number

2375

Protocol

TCP

Service

Docker Remote API

Range

IANA Registered (1024–49151)

Description

The Docker daemon exposes a REST API for managing containers, images, networks, and volumes. Port 2375 serves this API over plaintext TCP. A single unauthenticated request to port 2375 can run a privileged container that mounts the host root filesystem, giving an attacker complete root access. Thousands of Docker hosts with exposed port 2375 have been compromised in mass cryptomining campaigns. The Unix socket /var/run/docker.sock is the safe default for local tooling.

Security risks

1Instant root access: docker run -v /:/host --privileged alpine chroot /host – one HTTP request to port 2375 gives the attacker a root shell on the host. No authentication, no barriers. This is the single most dangerous port to expose on a Linux server.
2Cryptomining botnets: automated scanners continuously probe port 2375 across the internet. Within minutes of exposure, attackers deploy cryptomining containers. Shodan regularly indexes 5,000+ exposed Docker APIs.
3Supply chain attacks: an attacker with API access can modify running containers (inject malware), push poisoned images to your local registry, and alter docker-compose configurations for persistence across restarts.
4Container escape to host: even without --privileged, Docker API access enables mounting sensitive host paths (/etc/shadow, /root/.ssh/) into containers for credential theft. --privileged + host PID namespace = full escape.

Firewall guidance

Block port 2375 at the host firewall unconditionally (iptables -A INPUT -p tcp --dport 2375 -j DROP). Never set -H tcp://0.0.0.0:2375 in daemon.json or dockerd arguments. For remote Docker access, configure TLS certificates and use port 2376. For local access, use the Unix socket (/var/run/docker.sock). Docker Desktop for Mac/Windows does not expose TCP ports by default.

Diagnosis commands

Test if Docker API is exposed (if this returns data, you are critically vulnerable)

shell

curl -s http://host:2375/version | jq .ApiVersion

Check if port 2375 is open remotely

shell

nmap -p 2375 target

Check if dockerd is listening on TCP 2375 locally

shell

ss -tnlp sport = :2375

Find any configuration enabling TCP 2375

shell

grep -r '2375' /etc/docker/ /etc/systemd/system/docker*

Usage examples

Port 2375 – Docker Daemon (unencrypted)

shell

curl http://localhost:2375/version
# NEVER: -H tcp://0.0.0.0:2375 in dockerd config
docker context create remote --docker host=tcp://server:2376

Common services on this port

Docker EnginePodman (compatible API)PortainerRancherWatchtower

Related ports

2376

Docker TLS (secure remote)

2377

Docker Swarm management

9000

Portainer (Docker management UI)

History

Docker was released in 2013. Port 2375 was chosen for the unencrypted API, 2376 for TLS. Early Docker documentation showed TCP socket configuration for remote access, leading to widespread exposure. Docker 1.12 (2016) added Swarm mode with built-in TLS on port 2377. Modern Docker defaults to Unix socket only.

FAQ

Is Docker socket (/var/run/docker.sock) any safer than port 2375?

Yes – the socket is only accessible to users in the 'docker' group (effectively root-equivalent locally, but not remotely exploitable). Port 2375 is remotely exploitable by anyone on the network. The socket is the correct default; never replace it with TCP 2375.

How do I set up secure remote Docker access?

Generate TLS certificates (dockerd --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem -H tcp://0.0.0.0:2376). Clients use: docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H tcp://host:2376. Or use SSH: docker -H ssh://user@host.