2376

Port 2376/tcp is registered with IANA as docker-s with the description "Docker REST API (ssl)," assignee [DOCKER], contact Christopher Liljenstolpe, registration date 2014-04-17, and a blank reference field; there is no corresponding UDP registration. It is the default TCP port on which the Docker Engine listens for remote API calls when the daemon is configured for TLS. It is the encrypted sibling of port 2375 (plaintext docker): where 2375 carries the Docker REST API in the clear, 2376 wraps the same API in TLS and, in the documented secure posture, requires mutual authentication — the daemon is started with --tlsverify, --tlscacert, --tlscert, and --tlskey, and clients must present a valid certificate signed by the trusted CA before a connection is accepted. The remote API is the full control surface of the Docker daemon: anyone able to reach it can create privileged containers, bind-mount the host filesystem, and effectively gain root on the host, with no sudo or docker-group membership required once certificate auth is satisfied. For an analyst the security framing matters most. Although TLS is the intended security boundary, 2376 is actively scanned by threat actors and researchers hunting exposed Docker daemons, and misconfigurations (self-signed certs accepted by clients, no enforced mutual auth, the daemon bound to 0.0.0.0 without --tlsverify) leave instances exploitable. Docker's own documentation warns that possession of valid TLS keys is equivalent to host root. Campaigns reach Docker targets via unauthenticated TCP exposure on 2375/2376 and use bind-mount techniques for lateral movement and credential harvesting; some malware queries Shodan to discover exposed Docker API ports as a victim-discovery mechanism. No CVE is assigned to the port itself, but daemons reachable here inherit container-runtime CVEs such as CVE-2019-5736 (runC escape) and CVE-2021-41091 (containerd). Recommended posture: block 2376 from the public internet, restrict to trusted IP ranges or VPN, and prefer local Unix-socket access.

IANA assignment

docker-s — "Docker REST API (ssl)"; reference (blank — no RFC cited in IANA registry); assignee [DOCKER]; contact Christopher Liljenstolpe; registered 2014-04-17; TCP only (no UDP registration) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

registered (1024–49151)

Related ports

2375/tcp (plaintext Docker REST API), 2377/tcp (Docker Swarm cluster management)

Primary use

TLS-secured Docker daemon remote API (HTTPS); default port for --tlsverify mutual-TLS Docker Engine remote access; the encrypted counterpart of 2375 (plaintext)

Common software

Docker Engine / Docker Desktop (primary); remote-management and orchestration tooling that drives Docker (Portainer, Rancher, Docker Swarm)

Security implications

actively scanned for exposed Docker daemons; valid TLS keys equal host root (no sudo/docker-group needed); misconfig (no enforced mutual auth, daemon bound to 0.0.0.0) leaves instances exploitable; campaigns reach 2375/2376 via unauthenticated exposure and bind-mount the host filesystem for lateral movement and credential harvesting; malware queries Shodan for exposed Docker API ports

Notable CVEs

none specific to the port; daemons reachable here inherit container-runtime CVEs — CVE-2019-5736 (runC container escape), CVE-2021-41091 (containerd)

Typically seen on

hosts running the Docker Engine with TLS-enabled remote access; CI/CD and container-management infrastructure

Analyst note

an exposed 2376 should be confirmed as enforcing mutual TLS — a daemon reachable here without verified client-cert auth is effectively remote host root; treat public exposure as a serious finding.