Skip to main content
protocols.pageprotocols.page
2376

Port 2376 – Docker Daemon (TLS)

TCP

Port 2376 is the Docker daemon's TLS-protected REST API port. It requires mutual TLS authentication – both the server and client present certificates signed by a shared CA. This is the secure alternative to port 2375 for remote Docker access. Docker Machine and Docker Context use port 2376 when connecting to remote hosts.

Port Number

2376

Protocol

TCP

Service

Docker Remote API over TLS

Range

IANA Registered (1024–49151)

Description

Port 2376 requires --tlsverify on the daemon and client, with CA certificate, server certificate, and client certificate all in play. The daemon only accepts connections from clients whose certificates are signed by the configured CA. This provides authentication (who can connect) and encryption (traffic can't be intercepted). Docker Desktop remote contexts use this pattern.

Security risks

  • 1Certificate management: the TLS certificates for port 2376 grant root-equivalent access. If client certificates are leaked, stolen, or shared via insecure channels (email, Slack, unencrypted S3), the attacker has full Docker host control. Rotate certificates regularly and store them in a vault.
  • 2CA compromise: all clients trust the same CA. If the CA private key is compromised, an attacker can issue themselves a valid client cert. Keep the CA key offline or in an HSM. Do not store it on the Docker host itself.
  • 3Fallback to 2375: if TLS is misconfigured and the daemon fails to start with --tlsverify, administrators sometimes fall back to port 2375 (plaintext) 'temporarily' and forget to fix it. Monitor for any listener on 2375.

Firewall guidance

Allow inbound 2376 only from known admin/CI IPs that hold valid client certificates. The mTLS requirement provides authentication, but IP restriction adds defense-in-depth. Consider using 'docker -H ssh://user@host' instead of port 2376 – SSH is easier to manage (existing keys, no CA infrastructure) and equally secure.

Diagnosis commands

Test TLS Docker connection with client cert

shell
docker --tlsverify -H tcp://host:2376 version

Test TLS handshake and certificate chain

shell
openssl s_client -connect host:2376 -cert cert.pem -key key.pem -CAfile ca.pem

REST API test via curl with mTLS

shell
curl --cert cert.pem --key key.pem --cacert ca.pem https://host:2376/version

Usage examples

Port 2376 – Docker Daemon (TLS)
shell
docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H tcp://server:2376 ps
docker context create remote --docker host=tcp://server:2376,ca=ca.pem,cert=cert.pem,key=key.pem

Common services on this port

Docker EngineDocker MachineDocker ContextPortainer (remote)Rancher

Related ports

2375

Docker unencrypted (never use)

2377

Docker Swarm management

22

SSH (alternative: docker -H ssh://)

History

Port 2376 was defined alongside 2375 when Docker added remote API support in 2014. Docker Machine (now deprecated) automated TLS certificate generation for remote hosts. Docker 19.03 (2019) added SSH transport as a simpler alternative to managing TLS certificates.

FAQ

Port 2376 vs SSH for remote Docker?

SSH (docker -H ssh://user@host) is simpler – uses existing SSH keys, no CA infrastructure, no certificate rotation. Port 2376 (TLS) is better for automated systems (CI/CD) where SSH agent forwarding is impractical. Both provide equivalent security. SSH is the modern recommendation for human operators.