TCP Port 2376 – Docker Remote API (TLS)

Port 2376 is the conventional port for the Docker daemon remote API protected by TLS. When set up with client certificate verification, only holders of a signed certificate can issue commands to the Docker host. It is the intended safer counterpart to the unencrypted API on port 2375.

About TCP Port 2376

Port 2376 is registered with the Internet Assigned Numbers Authority (IANA) for docker-s. The IANA description reads: ‘Docker REST API (ssl)’.

Security Considerations

TLS on this port only helps when certificate verification is actually turned on. A daemon configured to verify client certificates protects itself; one running TLS without client verification is nearly as exposed as the plain API on 2375. Since Docker API access equals root on the host, restrict the port to known management addresses and treat certificate handling seriously. Access over SSH is a solid alternative that removes the certificate management problem entirely.

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry.