Port 2376 (Docker API (TLS))

Docker Engine remote API over TLS, typically with --tlsverify and client certificates.

Registered (user) port, 1024-49151 TCP Containers and Kubernetes Expose only to trusted sources

What port 2376 is used for

Docker Engine remote API over TLS, typically with --tlsverify and client certificates.

Security: should port 2376 be open?

Expose only to trusted sources. Safe only with --tlsverify; without client-certificate checking it is as dangerous as 2375. Restrict to admin hosts.

IANA assignment

Service nameProtoDescriptionAssigneeReference

docker-s TCP Docker REST API (ssl) DOCKER -

Registry dates for this port: registered 2014-04-17.

Check what is listening on port 2376

Linux: is anything listening on TCP 2376?

sudo ss -tlnp 'sport = :2376'

Linux / macOS: which process owns the port

sudo lsof -nP -i :2376

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':2376 '

Windows (Command Prompt)

netstat -ano | findstr :2376

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 2376 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 2376

From Windows

Test-NetConnection HOST -Port 2376

Allow only trusted sources on port 2376 in the firewall

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)

sudo ufw allow from 203.0.113.10 to any port 2376 proto tcp

iptables

sudo iptables -A INPUT -p tcp --dport 2376 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 2376 -j DROP

nftables

sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 2376 accept
sudo nft add rule inet filter input tcp dport 2376 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'TCP 2376 trusted' -Direction Inbound -Protocol TCP -LocalPort 2376 -RemoteAddress 203.0.113.10 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.