Port 2375 (Docker API (unencrypted))
Docker Engine remote API without TLS.
- Transport
- TCP
- Internet exposure
- Never expose
Should not be reachable from the internet.
Security notes
- An exposed, unauthenticated Docker API gives full control of the host: attackers start containers that mount the host file system.
- Widely exploited to deploy cryptominers. Use the socket locally, or TLS on 2376 with client certificates.
When it shows up in your logs
Any inbound connection to 2375 from outside is likely exploitation.