Port 2375 Docker API – Free, Online, Private

What listens on 2375

Port 2375 is the Docker Engine API without TLS. The IANA name is docker, Docker REST API (plain text), assigned in 2014. dockerd listens here only if you set a tcp host. The default on a Linux workstation is a Unix socket, /var/run/docker.sock, which does not use this port at all. A client uses the same HTTP API over that socket or over TCP. Port 2376 is docker-s, Docker REST API (ssl). Turning on TLS means moving to 2376 or serving TLS on whatever port you chose. It does not make 2375 encrypted. UDP 2375 is reserved.

The IANA service name is docker: Docker REST API (plain text). The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 2375. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 2375

Service notes for port 2375: the IANA name is docker (Docker REST API (plain text)), and the program people mean is Docker API. TCP 2375 is the IANA docker port, the Docker Engine API in cleartext. TLS is 2376, docker-s, which is a different assignment. UDP 2375 is reserved. Anyone who can open 2375 can start a container with the host's PID namespace and its disk mounted, which is root on the host. Do not publish this port. Do not 'temporarily' open it for a CI job. If a remote API is required, use 2376 with client certificates, or use SSH as the Docker context, which reuses port 22 and your existing keys. A security group of 0.0.0.0/0 on 2375 is a standing incident. The Unix socket has the same power for any local user in the docker group. That is a local privilege boundary, not a network one. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 2375, you are on the wrong page.

DOCKER_HOST=tcp://host:2375 in a shell profile will silently aim every docker command at a remote daemon. Read the error. A connection refused means nothing is listening. A 403 or a TLS error means you reached 2376 or a TLS listener with the wrong client. Another trap is a compose file that publishes 2375 because a tutorial did. ss on the host shows docker-proxy, and the daemon inside may still be on a socket. Another is confusing this port with the published port of a container. A web container on 80 is not the engine API.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 2375 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. If ss shows nothing on 2375, the engine is on the Unix socket, which is the safer default. If it shows dockerd or docker-proxy on 0.0.0.0, you have a network API. Confirm you meant to.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• 2375 is cleartext. 2376 is the TLS assignment, docker-s.
• The default local API is a Unix socket, not a port.
• Reaching this API is equivalent to root on the daemon's host.
• UDP is reserved and is not the API.

Linuxsudo ss -lptn 'sport = :2375'
sudo lsof -nP -iTCP:2375 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:2375 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.2375[^0-9]'

Windowsnetstat -ano | findstr :2375
Get-NetTCPConnection -LocalPort 2375

Remotenc -vz host 2375