# Docker API

- **URL:** https://hackindex.io/services/docker-api
- **Type:** Service
- **Default ports:** 2375, 2376
- **Tags:** docker, api, containers, linux, remote-execution
- **Published:** 2026-04-04
- **Updated:** 2026-07-13

The Docker Engine API provides programmatic control over Docker containers, images, volumes, and networks. It listens on **TCP port 2375** for unencrypted HTTP and **TCP port 2376** for TLS-encrypted connections. Nmap identifies it as `docker` or `http` on these ports.

An exposed Docker API without authentication is equivalent to root access on the host. The API allows creating privileged containers with the host filesystem mounted, effectively giving an attacker full control over the underlying system. This is one of the most critical misconfigurations found during cloud and infrastructure assessments. Attackers routinely scan for open Docker APIs to deploy cryptominers, establish persistence, or pivot into internal networks.

Enumeration starts with querying the `/version` and `/info` endpoints to confirm access and retrieve Docker version, OS details, and configuration. Listing containers (`/containers/json`), images (`/images/json`), and volumes reveals the scope of the deployment. Exploitation typically involves creating a new container with `-v /:/mnt` to mount the host root filesystem, then reading `/etc/shadow`, writing SSH keys, or scheduling a cron job for a reverse shell.

## Phases

- [Enumeration](https://hackindex.io/services/docker-api/enumeration.md): Detect exposed Docker API ports and enumerate containers and images (1 guides)
- [Vulnerability Discovery](https://hackindex.io/services/docker-api/vulnerability-discovery.md): Find open Docker APIs, dump env vars, and spot privileged containers (1 guides)
- [Exploitation](https://hackindex.io/services/docker-api/exploitation.md): Container escape, RCE, and secret extraction via Docker API (2 guides)