Containers & cloudTCP 2375, 2376 Cleartext by default
Port 2375, 2376: Docker API
Docker Engine API
Remote control of the Docker daemon. 2375 is unencrypted and unauthenticated; 2376 uses TLS.
Secure alternative: 2376 with mutual TLS
How attackers abuse it
- An exposed 2375 hands an attacker root on the host - frequently abused for cryptomining.
How to defend it
- Never expose the Docker socket or 2375.
- Use 2376 with mutual TLS, or SSH, for remote management.
Exam tip
Access to the Docker daemon is equivalent to root on the host.