What uses port 2376
Port 2376 is the Docker API protected by mutual TLS: the client needs a certificate signed by a CA the daemon trusts. It is used for remote Docker hosts and Docker Machine setups. For occasional remote access, docker context create --docker host=ssh://user@host over SSH is simpler and avoids managing certificates.
Should port 2376 be open to the internet?
Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.
Check what is listening on port 2376
sudo ss -ltnp 'sport = :2376'sudo lsof -nP -iTCP:2376 -sTCP:LISTENGet-NetTCPConnection -LocalPort 2376 -State Listen
netstat -ano | findstr :2376No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.
Fix “address already in use” on port 2376
Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:
sudo kill $(sudo lsof -t -iTCP:2376 -sTCP:LISTEN)Stop-Process -Id (Get-NetTCPConnection -LocalPort 2376 -State Listen).OwningProcessAllow port 2376 from trusted networks only
The examples allow 2376 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.
sudo ufw allow from 10.0.0.0/8 to any port 2376 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 2376 proto tcpsudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="2376" protocol="tcp" accept'
sudo firewall-cmd --reloadNew-NetFirewallRule -DisplayName "Docker API (TLS) 2376/TCP" -Direction Inbound -Protocol TCP -LocalPort 2376 -Action Allow -RemoteAddress 10.0.0.0/8On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.
Test port 2376 from another machine
nc -zv example.com 2376Test-NetConnection example.com -Port 2376Related ports
- Port 2375 (Docker API (unencrypted)): the Docker daemon API without TLS.
- Port 22 (SSH): used by SSH for secure remote logins, SFTP, SCP and Git over SSH.
- Port 6443 (Kubernetes API server): the default port of the Kubernetes API server.
More containers and orchestration ports
2379 (etcd client) , 2380 (etcd peer) , 10250 (Kubelet API) . See all ports in the port lookup.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What is port 2376 used for?
Port 2376 is the Docker daemon API secured with TLS. Port 2376 is the Docker API protected by mutual TLS: the client needs a certificate signed by a CA the daemon trusts. It is used for remote Docker hosts and Docker Machine setups. For occasional remote access, docker context create --docker host=ssh://user@host over SSH is simpler and avoids managing certificates.
Is it safe to open port 2376?
Only open this port to known networks or users, for example your office IP, a VPN or behind authentication. Allow it only from the networks that need it, as in the firewall examples on this page.
How do I check if port 2376 is open?
On the server, list listening sockets with "sudo ss -ltnp 'sport = :2376'" on Linux or "sudo lsof -nP -i :2376" on macOS. From another machine, run "nc -zv host 2376" or, on Windows, "Test-NetConnection host -Port 2376". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.