Port 2375 is the conventional TCP port for the Docker daemon’s remote API without TLS. Anyone who can reach that API and talk to it without credentials can usually act with the daemon’s authority, which on most hosts means control over the machine itself. An open 2375 on a server you run is therefore a serious finding. The headline count of 1,436,696 hosts is a different matter: it comes from the title of an indexed DEV Community article dated September 22, 2026, and we could not review the article’s text or its method, so the number is an unverified claim rather than a measured census. The useful question for an operator is narrower: does your own Docker daemon listen on 2375, who can reach it, and does it require verified credentials?
What the 1,436,696 figure does and does not establish
The number appears in the title of a DEV Community listing dated September 22, 2026. The listing shows the title and date, but the article body and its scan method were not available to us. Several details that determine what the number means are therefore unknown:
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Whether 1,436,696 counts unique hosts, open endpoints, scan responses or historical observations.
- When and where the scan ran, and which search query or filters it used.
- Whether results were deduplicated across scans or addresses.
- Whether each result was confirmed as a Docker daemon answering API requests without authentication.
Until the underlying method is published, the figure should be read as “the article reports 1,436,696 hosts on port 2375.” It is not a current global census, and it is not a count of confirmed vulnerable machines. The rest of this article is about the underlying technical question, which can be checked on any system you administer.
What port 2375 conventionally means
Docker’s documentation on configuring remote access for the daemon describes TCP 2376 as the conventional port for the daemon over TLS, and TCP 2375 as the conventional port for non-TLS access. Both are conventions. The daemon listens wherever it is configured to listen, and the same guide warns that the firewall must be configured when remote access is intended.
#1 Best Overall
A port number is therefore not a fingerprint. Another service can use 2375, and a Docker daemon can listen on a different port. Identifying a daemon requires a protocol-level check against a system you control, such as the version endpoint of the API, and even that check tells you about one listener at one network location.
Why an unauthenticated daemon is a control-plane problem
The Docker daemon creates, starts and inspects containers. A container can be started with host paths mounted into it, including the host’s root filesystem, or with elevated privileges. Docker’s security documentation states that TCP access to the daemon is unencrypted and unauthenticated by default, and that changing the daemon’s binding can create host-root risk. The OWASP Docker Security Cheat Sheet advises against exposing the Docker daemon socket to an internet-connected network for the same reason: daemon access confers powerful control over the host.
Recommended Free Tools
Rank #2
The core issue is therefore not that a port is open. It is that a successful connection to an unauthenticated API gives the caller the daemon’s authority, and the daemon’s authority is effectively the host’s.
Separating the claims: open port, reachable API, unauthenticated daemon, host control
Scanners, reports and incident notes often blur four different claims. Each needs different evidence.
Rank #3
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
| Claim | What must be true | What would confirm it | What it does not prove |
| Port 2375 is open | Something accepts a TCP connection on 2375 at an address | A TCP connection succeeds from a specific network location | That the listener is Docker, or that it is authenticated |
| The Docker API is reachable | The listener answers with Docker API responses | A valid API response from that location | Whether the same location would be allowed by policy |
| The daemon is unauthenticated | API calls succeed without a verified client credential | An API call that returns data without client certificates | Whether the host is reachable from the internet |
| Host-level control is possible | The API will create or modify containers with host mounts or privileges | Testing on a system you own, in an isolated environment | Anything about other hosts with the same port open |
Check your own hosts
- List local listeners on each Docker host. Run
sudo ss -tlnp | grep -E ':(2375|2376)b'. Listeners bound to 0.0.0.0 or a public address are the ones that matter most. An empty result means nothing on that host is listening on either port. - Read the daemon configuration. Check
/etc/docker/daemon.jsonfor ahostsentry, and runsystemctl cat dockerto find any-Hflags in the unit or its drop-ins. Atcp://listener without TLS should be removed. - Test from a network location that should not have access. From an outside host you administer, run
nc -vz your-host 2375. A refused or timed-out connection is the expected result. Test only systems you are authorized to test. - Review the boundary. Check host firewall rules (for example
sudo ufw status verbose, or your nftables or iptables rules), plus any cloud security groups or load balancers that forward to the host.
Choosing how to reach the daemon remotely
Most operators need one of three arrangements. Pick the least exposed one that meets the workflow.
Local Unix socket
On Linux the daemon listens on the Unix socket /var/run/docker.sock by default. Access is controlled by the socket’s file permissions and by membership in the docker group. Docker’s guidance treats that group as privileged, because membership gives effective root on the host. If no remote API is needed, this is the arrangement to use, and any TCP listener should be removed.
TLS-protected TCP on port 2376
Docker’s guide to protecting the daemon socket describes running the daemon with TLS and requiring verified client certificates. The daemon verifies the client’s certificate against a certificate authority you control, and the connection is encrypted. A minimal server invocation looks like this, with paths adjusted for your environment:
dockerd --tlsverify --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem --tlskey=/etc/docker/certs/server-key.pem -H=10.0.0.5:2376
Clients then connect with a client certificate signed by the same authority:
Best Value
docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=tcp://10.0.0.5:2376 version
Binding to a specific private address rather than 0.0.0.0 reduces what the listener is exposed on. If the daemon is started by systemd, the same settings can go in /etc/docker/daemon.json using the tls, tlsverify, tlscacert, tlscert, tlskey and hosts keys, but the unit file must not also pass -H, because the daemon refuses to start when the same directive is set both ways. Client key files need restricted permissions, and you need a process for revoking a certificate when someone leaves or a key is lost.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →SSH through a Docker context
Docker contexts can tunnel the API over SSH, so the daemon needs no TCP listener at all. The remote user must be able to run Docker on the host, which usually means membership in the docker group, and the connection relies on your SSH key management and host key verification.
docker context create remote --docker 'host=ssh://[email protected]' docker --context remote ps
Comparison of the three arrangements
| Axis | Local Unix socket | TLS-protected TCP (2376) | SSH context |
| Authentication and identity | Local account and docker group membership |
Client certificate signed by your CA, verified by the daemon | SSH key or password for the remote user, plus Docker access on the host |
| Transport encryption | Not applicable; no network path | TLS | SSH transport encryption |
| Network boundary | Host-local only | A listening port that must be restricted to trusted sources | The SSH port only; no Docker TCP listener |
| Setup and operating burden | None beyond a standard installation | Certificate issuance, distribution, rotation and revocation | SSH access management and maintained host keys |
No option is best in every environment. The right choice depends on who needs access, from where, and how much certificate or SSH key management your team can sustain.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If you find an exposed daemon
- Close the path first. Block the port at the host firewall and in any cloud security group. Then remove the unprotected TCP listener from
daemon.jsonor the systemd unit, and runsudo systemctl restart docker. Clients that depended on that listener will stop working until they are moved to TLS or SSH. - Check what ran on the host. List containers with
docker ps -aand inspect any you cannot account for withdocker inspect, paying attention to bind mounts and privileged settings. Check creation times against your change records and host logs. - Treat secrets on the host as exposed. A container with host access could read files, environment variables and credentials stored there. Rotate them.
- If you cannot account for unexpected containers, treat the host as compromised and rebuild it from a known-good image rather than trying to clean it in place.
- Repeat the external test from the earlier checklist and confirm the port no longer answers from outside your network.
Restarting the daemon also stops running containers unless they use a restart policy, so schedule the change where that is acceptable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
