2376 Docker-daemon-TLS TCP

What it's for

Port 2376 is the TLS-secured version of the Docker daemon's remote API — the same remote control capability as port 2375 (creating/managing containers on a Docker host from another machine), but requiring mutual TLS certificate authentication before any command is accepted.

Protocol basics

Functionally, the Docker API on port 2376 is identical to 2375 — same REST endpoints, same capabilities — but the connection requires a valid client certificate signed by a CA the daemon trusts, meaning an attacker can't simply connect and issue commands the way they could against an unprotected port 2375 instance. This is the recommended way to expose remote Docker API access when it's genuinely needed (for build servers, orchestration tooling, etc.), though many teams avoid exposing it directly at all in favor of tools like Docker Contexts over SSH, which tunnel the API through an already-authenticated SSH connection instead.