177 Hosts on Port 2375: Why a Small Exposure Number Can Still Be the Most Important One

A ZoomEye query for port:2375 returned 177 matching hosts at the time of writing. In a session where other queries returned hundreds of thousands of results, this is a small number. It is also, in practical terms, one of the more consequential.

What port 2375 is

Port 2375 is the Docker daemon's unencrypted REST API endpoint. When the daemon is configured to listen on this port, it accepts API calls over plain HTTP. The API is not a read-only status interface: it supports creating containers, mounting host directories into them, and executing commands inside them.

Access to the Docker API is, for practical purposes, equivalent to root access on the host. A container can be created that mounts the host filesystem, and the attacker can then read or modify anything the daemon can reach. This is not a subtle privilege escalation; it is direct host control.

Why the number is small

Port 2375 exposure is small relative to other services because the risk is well understood and the fix is straightforward. Docker's documentation recommends against exposing the daemon socket, and the default configuration on most installations uses a Unix socket with filesystem permissions rather than a network listener.

That is also why the remaining 177 are worth attention. A host that answers on 2375 is not exposed by accident of a default setting in most cases; it is exposed because someone deliberately configured the daemon to listen on a network interface. That configuration decision may have been made for a specific integration, and it may have been made years ago and forgotten.

What the query measures

The query port:2375 matches hosts where ZoomEye observed the port open. It does not confirm that the endpoint is the Docker API, nor does it confirm that the API accepts unauthenticated requests. Docker can be configured with TLS and client certificate authentication on a network listener, and such a configuration would still answer on the port.

The distinction matters for prioritisation. A TLS-protected Docker API that answers on 2375 is a much smaller concern than one that accepts unauthenticated HTTP requests. Confirming which is present requires an authenticated check from a trusted position, not an external scan.

Why small numbers deserve attention

Exposure reduction programmes tend to prioritise by count, because a service with hundreds of thousands of instances appears to offer more opportunity than one with fewer than two hundred. That heuristic is reasonable when the per-instance risk is similar. It fails when the per-instance risk is not.

A single unauthenticated Docker API endpoint can yield complete control of the host and, through the containers running on it, of the applications and credentials those containers hold. The expected loss from one such host can exceed the expected loss from a large number of low-impact exposures.

The practical implication is that the 177 should be enumerable. An organisation can determine whether any of them belong to it, and if so, whether the exposure was intentional and whether authentication is enforced. That is a tractable piece of work in a way that reviewing hundreds of thousands of hosts is not.

Practical steps

Check whether the Docker daemon is listening on a network interface at all. The recommended configuration uses a Unix socket, and a network listener should be a deliberate decision with a documented reason.

Where a network listener is required, enable TLS with client certificate authentication. Docker supports this, and it converts an unauthenticated control plane into an authenticated one.

Restrict reachability. A Docker API that must be reachable should be reachable only from the systems that need it, not from the general network.

Audit for the exposure in the organisation's own address space. The count is small enough that a definitive answer is achievable.

References

• ZoomEye query port:2375, executed for this article. Result count and collection time are recorded in the source metadata.
• Docker documentation on daemon socket configuration and TLS protection for the remote API.
• ZoomEye internet attack surface management platform documentation, asset discovery and continuous monitoring capabilities.