Tutorial 4 min read

How to Find Exposed Docker Daemon APIs

Locate Docker daemons with unauthenticated API access — a critical security risk.

Search for Docker API (HTTP)

Docker daemon API on port 2375 (unencrypted) — the most dangerous misconfiguration.

lightbulb

An exposed Docker API = full root access on the host.

Port 2376 is the TLS-encrypted Docker daemon port.

Focus on a specific region.

check_circle Never expose Docker daemon on 0.0.0.0 — bind to unix socket or localhost only
check_circle If remote access is needed, use TLS mutual authentication (--tlsverify)
check_circle Use Docker contexts instead of exposing the daemon directly
check_circle Consider using Portainer or Docker Swarm with proper auth instead
check_circle Monitor for unauthorized container creation