What uses port 2375
The Docker daemon can expose its REST API on TCP 2375. Anyone who can reach it controls Docker, which means root on the host: they can start a container that mounts the host’s filesystem. Exposed 2375 ports are one of the most common ways servers get taken over for cryptocurrency mining. Use the local Unix socket, SSH (DOCKER_HOST=ssh://user@host) or TLS on 2376 instead.
Should port 2375 be open to the internet?
Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.
-
If
dockerdwas started with-H tcp://0.0.0.0:2375, remove it from the systemd unit ordaemon.json, restart Docker, and check for unknown containers.
Check what is listening on port 2375
sudo ss -ltnp 'sport = :2375'sudo lsof -nP -iTCP:2375 -sTCP:LISTENGet-NetTCPConnection -LocalPort 2375 -State Listen
netstat -ano | findstr :2375No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.
Fix “address already in use” on port 2375
Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:
sudo kill $(sudo lsof -t -iTCP:2375 -sTCP:LISTEN)Stop-Process -Id (Get-NetTCPConnection -LocalPort 2375 -State Listen).OwningProcessAllow port 2375 from trusted networks only
The examples allow 2375 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.
sudo ufw allow from 10.0.0.0/8 to any port 2375 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 2375 proto tcpsudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="2375" protocol="tcp" accept'
sudo firewall-cmd --reloadNew-NetFirewallRule -DisplayName "Docker API (unencrypted) 2375/TCP" -Direction Inbound -Protocol TCP -LocalPort 2375 -Action Allow -RemoteAddress 10.0.0.0/8On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.
Test port 2375 from another machine
nc -zv example.com 2375Test-NetConnection example.com -Port 2375Related ports
- Port 2376 (Docker API (TLS)): the Docker daemon API secured with TLS.
- Port 6443 (Kubernetes API server): the default port of the Kubernetes API server.
- Port 10250 (Kubelet API): the kubelet API on every Kubernetes node.
More containers and orchestration ports
2379 (etcd client) , 2380 (etcd peer) . See all ports in the port lookup.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What is port 2375 used for?
Port 2375 is the Docker daemon API without TLS. The Docker daemon can expose its REST API on TCP 2375. Anyone who can reach it controls Docker, which means root on the host: they can start a container that mounts the host’s filesystem. Exposed 2375 ports are one of the most common ways servers get taken over for cryptocurrency mining. Use the local Unix socket, SSH (DOCKER_HOST=ssh://user@host) or TLS on 2376 instead.
Is it safe to open port 2375?
Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.
How do I check if port 2375 is open?
On the server, list listening sockets with "sudo ss -ltnp 'sport = :2375'" on Linux or "sudo lsof -nP -i :2375" on macOS. From another machine, run "nc -zv host 2375" or, on Windows, "Test-NetConnection host -Port 2375". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.