Port 2376 / TCP
Docker Daemon (TLS)
Port 2376 – Docker Daemon (TLS) Protocol Specification
Technical analysis, security advisories, vulnerability mitigation, and firewall syntax for TCP/UDP port 2376 (Docker Daemon (TLS)).
Port Number
2376
Transport Protocol
TCP
Port Range Type
Registered (1024-49151)
Default Status
Restricted / LAN
Service Description & Architectural Context
Secure Docker Engine REST API protected with mutual client/server TLS.
IANA / RFC Designation:
Port 2376 is assigned to Docker Daemon (TLS) under the Internet Assigned Numbers Authority (IANA) service name registry. In enterprise infrastructure and homelab setups, services listening on this port must follow the principle of least privilege.
Security Analysis & Attack Surface Assessment
Verify client certificate validation is enforced; restrict source IP addresses.
Hardening Recommendations:
- Do not expose port 2376 to public WAN interfaces unless authenticated TLS or VPN wrapping is strictly enforced.
- Enforce rate-limiting using Fail2ban, CrowdSec, or cloud edge DDoS protection.
- Audit active listening sockets locally:
ss -tulpn | grep :2376ornetstat -ano | findstr :2376.
Firewall Rule Snippets for Port 2376
UFW (Ubuntu / Debian Linux)
sudo ufw allow 2376/tcp
iptables (Standard Linux Kernel)
sudo iptables -A INPUT -p tcp --dport 2376 -j ACCEPT
Windows PowerShell (Defender Advanced Firewall)
New-NetFirewallRule -DisplayName "Allow Port 2376" -Direction Inbound -LocalPort 2376 -Protocol TCP -Action Allow