Docker Remote API
The Docker Remote API (also called the Docker Engine API) is the HTTP interface the Docker daemon exposes for creating, starting and inspecting containers, documented directly in Docker's own API reference rather than an IETF or ISO standard. IANA registers TCP port 2375 for it in plaintext and 2376 for the TLS-secured version, but the API itself carries no authentication of its own -- Docker's documentation assumes a trusted local Unix socket or a properly configured TLS client-certificate setup, never a bare network port. Because the daemon runs as root and can mount a host's filesystem into any container it starts, a Remote API reachable on port 2375 without TLS gives an unauthenticated caller the equivalent of a root shell on the host, which is why cryptomining campaigns scan for it continuously rather than treating it as a minor misconfiguration.
By AdminKit team, Netbase JSC · Updated