Docker API

The Docker Engine API provides programmatic control over Docker containers, images, volumes, and networks. It listens on TCP port 2375 for unencrypted HTTP and TCP port 2376 for TLS-encrypted connections. Nmap identifies it as docker or http on these ports.

An exposed Docker API without authentication is equivalent to root access on the host. The API allows creating privileged containers with the host filesystem mounted, effectively giving an attacker full control over the underlying system. This is one of the most critical misconfigurations found during cloud and infrastructure assessments. Attackers routinely scan for open Docker APIs to deploy cryptominers, establish persistence, or pivot into internal networks.

Enumeration starts with querying the /version and /info endpoints to confirm access and retrieve Docker version, OS details, and configuration. Listing containers (/containers/json), images (/images/json), and volumes reveals the scope of the deployment. Exploitation typically involves creating a new container with -v /:/mnt to mount the host root filesystem, then reading /etc/shadow, writing SSH keys, or scheduling a cron job for a reverse shell.