Is the Docker API on port 2375 safe to leave open?

What is the Docker API?

The default port is 2376 if you're using TLS encrypted transport, or 2375 otherwise.

Docker runs the small software containers behind many websites and tools. Its daemon can take orders over the network.

Docker's documentation says the default port is 2375 without TLS encryption and 2376 with it.

Why does it matter?

Configuring Docker to accept connections from remote clients can leave you vulnerable to unauthorized access to the host and other attacks. It's critically important that you understand the security implications of opening Docker to the network. If steps aren't taken to secure the connection, it's possible for remote non-root users to gain root access on the host.

Whoever can send orders to the daemon controls the machine. Docker warns that if the connection is not secured, remote non-root users can gain root access on the host.

That means your web server, and anything it can reach, is in someone else's hands.

What do I do about it?

1. Block ports 2375 and 2376 in your firewall or cloud security group.
2. Set the daemon to listen only on its local socket.
3. If remote control is needed, use SSH or TLS with client certificates, as Docker's documentation describes.
4. Check the host for containers you did not start.