The Docker daemon's API is its entire control surface, and it is root-equivalent by design: anyone who can call it can start a container that mounts the host and runs as root. Locally the API lives on a Unix socket, but operators frequently expose it over TCP for remote management, on 2375 (plain HTTP, no authentication) or 2376 (TLS). An exposed 2375, or a 2376 with weak or optional TLS, hands full host control to any client that can reach the port, with no exploit required.
Find and probe an exposed daemon:
# scan for the Docker API ports
nmap -p 2375,2376 --open <target-range>
# a single unauthenticated request confirms control
curl -s http://<target>:2375/version
curl -s http://<target>:2375/info | head
A 200 with daemon version and info from 2375 means unauthenticated control.
Subtopics#
- Unauthenticated daemon access: an open 2375 with no authentication.
- Weak TLS on 2376: TLS present but misconfigured or optional.
- API enumeration: mapping containers, images, secrets, and networks through the API.
- Host takeover via privileged run: launching a container that owns the host.