Port 2375 Docker API · TCP

What runs on port 2375

Docker Engine API without TLS. Anyone who can reach this port can start a privileged container that mounts the host filesystem, which is root on the host. It is exposed by accident surprisingly often (a "hosts" setting meant for a local tool), and crypto-mining bots scan for it continuously. The socket /var/run/docker.sock is the normal way to talk to Docker; 2376 with TLS client certificates is the way to do it remotely.

Software that uses it: Docker Engine · Portainer agents · Docker contexts and docker -H tcp://

Should port 2375 be open?

Loopback or the host's own network only. The service should listen on 127.0.0.1 (or a Unix socket) and be reached by a reverse proxy or by the application on the same host. If it answers on a public address, that is a misconfiguration.

• curl http://host:2375/version from another machine: if that answers, you have a critical finding.
• For remote use, prefer docker context create --docker "host=ssh://user@host" over opening any port.

Check port 2375

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :2375'
sudo lsof -i :2375

# from another machine: is it reachable?
nc -zv host 2375
nmap -p 2375 host
curl -v telnet://host:2375      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 2375

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 2375 proto tcp
sudo ufw deny 2375/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 2375 accept
nft add rule inet filter input tcp dport 2375 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 2375 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 2375 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=2375 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 2375" with no source is just "open".

Related ports

• 2376 Docker API (TLS)
• 22 SSH — SSH, SCP, SFTP, git over ssh
• 6443 Kubernetes API

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions