Common attacks and weaknesses
- Host takeover if client certificates are not required or leak.
Port 2376: Docker API (TLS)
Docker Engine API over TLS.
2376
How Docker API (TLS) works
DevOps, cloud & containersCommands sent to port 2376 create and control containers or cluster resources on the host. Everything is encrypted: someone on the path only sees unreadable bytes.
- Transport
- TCP
- Exposure risk
- 6/10 high if reachable from the Internet
- Encryption
- EncryptedTLS or built-in crypto
- IANA status
- Assignedcommon use differs from the registry
- Range
- Registered (1024-49151)
- Category
- DevOps, cloud & containers
Is port 2376 dangerous?
How to secure it
- Require client certificates (tlsverify) and restrict by IP.
Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.
IANA registry entries for port 2376
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| docker-s | 2376 | TCP | Docker REST API (ssl) | - | 2014-04-17 |
// source: IANA service name and port number registry
Which program uses port 2376, and is it reachable?
Linux
sudo ss -ltnup 'sport = :2376' # process listening on 2376
sudo lsof -nP -i :2376macOS
sudo lsof -nP -i :2376
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 2376 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 2376 netstat -ano | findstr :2376
From another machine
nmap -p 2376 -sV <host> nc -zv <host> 2376
Block it in the firewall
sudo ufw deny 2376/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 2376" -Direction Inbound -LocalPort 2376 -Protocol TCP -Action Block # Windows
What is port 2376 used for?
Docker Engine API over TLS.
Is port 2376 TCP or UDP?
Port 2376 is registered for TCP.
Is it safe to open port 2376?
It is rated 6/10 (high) when exposed to the Internet. Host takeover if client certificates are not required or leak. Require client certificates (tlsverify) and restrict by IP.
How do I check if port 2376 is open?
On Linux run "ss -ltnup 'sport = :2376'", on macOS "lsof -nP -i :2376", and on Windows "netstat -ano | findstr :2376" to see the local process. From another machine, "nmap -p 2376 <host>" shows whether it is reachable.
Other devops, cloud & containers ports
:2375 Docker API (HTTP) tcp · critical risk :6443 Kubernetes API tcp · udp · high risk :10250 Kubelet API tcp · critical risk :2379 etcd tcp · critical risk :8500 Consul tcp · udp · high risk :4505 SaltStack tcp · critical risk :9000 PHP-FPM / SonarQube / Portainer tcp · udp · high risk :677 Virtual Presence Protocol tcp · udp