CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// DevOps, cloud & containers

Port 2376: Docker API (TLS)

Docker Engine API over TLS.

2376

How Docker API (TLS) works

DevOps, cloud & containers
adminhostdocker run adminhostdocker run

Commands sent to port 2376 create and control containers or cluster resources on the host. Everything is encrypted: someone on the path only sees unreadable bytes.

Transport
TCP
Exposure risk
6/10 high if reachable from the Internet
Encryption
EncryptedTLS or built-in crypto
IANA status
Assignedcommon use differs from the registry
Range
Registered (1024-49151)
Category
DevOps, cloud & containers
01 Security

Is port 2376 dangerous?

Common attacks and weaknesses

  • Host takeover if client certificates are not required or leak.

How to secure it

  • Require client certificates (tlsverify) and restrict by IP.

Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.

02 Registry

IANA registry entries for port 2376

ServicePortTransportDescriptionReferenceUpdated
docker-s 2376 TCP Docker REST API (ssl) - 2014-04-17

// source: IANA service name and port number registry

03 Check it

Which program uses port 2376, and is it reachable?

Linux

sudo ss -ltnup 'sport = :2376'      # process listening on 2376
sudo lsof -nP -i :2376

macOS

sudo lsof -nP -i :2376

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 2376 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 2376
netstat -ano | findstr :2376

From another machine

nmap -p 2376 -sV <host>
nc -zv <host> 2376

Block it in the firewall

sudo ufw deny 2376/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 2376" -Direction Inbound -LocalPort 2376 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 2376 used for?

Docker Engine API over TLS.

Is port 2376 TCP or UDP?

Port 2376 is registered for TCP.

Is it safe to open port 2376?

It is rated 6/10 (high) when exposed to the Internet. Host takeover if client certificates are not required or leak. Require client certificates (tlsverify) and restrict by IP.

How do I check if port 2376 is open?

On Linux run "ss -ltnup 'sport = :2376'", on macOS "lsof -nP -i :2376", and on Windows "netstat -ano | findstr :2376" to see the local process. From another machine, "nmap -p 2376 <host>" shows whether it is reachable.

05 Related
:2375 Docker API (HTTP) tcp · critical risk :6443 Kubernetes API tcp · udp · high risk :10250 Kubelet API tcp · critical risk :2379 etcd tcp · critical risk :8500 Consul tcp · udp · high risk :4505 SaltStack tcp · critical risk :9000 PHP-FPM / SonarQube / Portainer tcp · udp · high risk :677 Virtual Presence Protocol tcp · udp

Latest vulnerability news

All news