--- title: "Defending Against Worms Targeting Docker Remote Management" description: "Explains how worms exploit Docker's unencrypted remote management port and walks through hardening Docker remote management connections with TLS certificates." canonical_url: "https://blog.markkulab.net/en/post/prevent-docker-worm-remote-management-attacks" author: "Mark Ku" author_url: "https://blog.markkulab.net/en/author/mark-ku" site: "Mark Ku's Tech Notes" date_published: "2024-12-25 02:01:35 +0800" category: "Security" tags: ["docker", "tls", "security", "ubuntu", "linux", "remote access", "worm", "infra"] language: "en" license: "CC BY 4.0" license_url: "https://creativecommons.org/licenses/by/4.0/" attribution: "when reusing or quoting, credit the author and link back to the original" --- # Defending Against Worms Targeting Docker Remote Management ## Background After [migrating my Taiwan dev environment from Windows 11 to Linux](https://blog.markkulab.net/migrate-windows-to-linux-development-environment/), I unexpectedly noticed abnormal traffic on our network equipment, even causing network congestion. The original dev environment was Windows 11. Since Microsoft provides extensive protection against worms and malware, the system's security is relatively high. Linux is not inherently insecure, but its information security has to be self-managed. For example, when I once shared a database folder over Samba, I forgot to restrict write permissions, and after a few nights some unknown .exe files showed up in that folder. ## Initial investigation At first I thought I had installed something I shouldn't have, causing abnormal NAT traffic. But after multiple rounds of uninstalling software and cross-testing, the problem persisted. Eventually, I noticed several suspicious container services running in Docker - that was clearly the culprit. Even after limiting TCP/IP connections to 300 on the firewall, the router was still being overwhelmed, repeatedly bringing down the office network. ## Pinpointing the root cause After investigation, I found several anomalous Ubuntu containers running on the Docker host. My theory: someone's machine on the LAN was infected with a worm that, via Docker's remote management port, pulled the official Ubuntu Docker image, gained full control inside the container, and used these malicious containers to drain host resources - network, CPU, and disk - or steal data. ![unknown containers in docker](https://blog.markkulab.net/content/markku/posts/prevent-docker-worm-remote-management-attacks/images/docker-ps.png) ## How to avoid this kind of issue After understanding how worms exploit Docker's overly broad permissions, before locating which machine had the worm, I decided to harden security by adding TLS certificates so the dev machine's Docker couldn't be hijacked. ### Prerequisites - **Dev machine (Docker host)**: Ubuntu (192.168.0.123), with [the remote management port enabled](https://blog.markkulab.net/enable-docker-2375-port-in-ubuntu22/) - **Docker remote management - client**: Windows 11 - **Environment**: Docker installed on both machines ## Steps to generate TLS certificates ### 1. On the Ubuntu Docker host, generate the CA key and enter a passphrase ```bash openssl genrsa -aes256 -out ca-key.pem 4096 ``` > **Tip**: Keep the passphrase safe. Generate the CA certificate: ```bash openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem ``` ### 2. Generate the server key and certificate Generate the server key: ```bash openssl genrsa -out server-key.pem 4096 ``` Generate the server certificate signing request (CSR): ```bash openssl req -subj "/CN=*" -sha256 -new -key server-key.pem -out server.csr ``` Use the CA to sign the server certificate: ```bash openssl x509 -req -days 1000 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem ``` ### 3. Generate the client key and certificate Generate the client key: ```bash openssl genrsa -out key.pem 4096 ``` Generate the client certificate signing request (CSR): ```bash openssl req -subj "/CN=client" -new -key key.pem -out client.csr ``` Use the CA to sign the client certificate: ```bash openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem ``` ### 4. Modify the Docker configuration file Edit the Docker service config: ```bash vim /lib/systemd/system/docker.service ``` Change `ExecStart` to: ```bash ExecStart=/usr/bin/dockerd --tlsverify --tlscacert=/var/tls/ca.pem --tlscert=/var/tls/server-cert.pem --tlskey=/var/tls/server-key.pem -H tcp://0.0.0.0:2376 -H unix:///var/run/docker.sock ``` ### 5. Set file permissions Set permissions on the keys and certificates: ```bash chmod 0400 ca-key.pem server-key.pem key.pem chmod 0444 ca.pem server-cert.pem cert.pem ``` ### 6. Copy the certificates to the remote client Use SCP to copy the certificates to the Windows client: ```bash scp -r mark@192.168.0.123:/var/tls E:\tls ``` Windows users can place the certificates (ca.pem, cert.pem, and key.pem) into the `%USERPROFILE%/.docker` folder so they will be used automatically; otherwise they have to be specified manually. ![copy certificate](https://blog.markkulab.net/content/markku/posts/prevent-docker-worm-remote-management-attacks/images/copy-certificate.png) Linux users can place the certificates into `/etc/docker/certs.d` so they are used automatically. ### 7. Restart the Docker service Reload and restart Docker: ```bash systemctl daemon-reload systemctl restart docker ``` ## Testing Try the same command that previously managed Docker without certificates: ``` docker -H="tcp://192.168.0.123:2376" ps ``` Without the TLS certificate, Docker management is no longer allowed: ``` Error response from daemon: Client sent an HTTP request to an HTTPS server. ``` W Now, with the TLS certificates included, we can manage Docker remotely: ``` docker --tls -H="tcp://192.168.0.123:2376" ps ``` ![docker ps with tls](https://blog.markkulab.net/content/markku/posts/prevent-docker-worm-remote-management-attacks/images/docker-ps-2.png) ## Wrap-up After enabling TLS, no more unknown containers or NAT-saturating traffic appeared. I really didn't expect that an unencrypted Docker remote management port could be exploited by worms so easily. Information security is especially important on Linux. By deploying TLS certificates, we effectively raised the security of Docker remote management, preventing resource exhaustion and network outages from hacker exploits. I'd also recommend periodically reviewing Docker containers and image sources to reduce risk. ## Addendum You can use Wireshark to capture traffic and check whether any LAN machines exhibit anomalous behavior. ## References * [The Docker you really want!!! TLS-encrypted remote Docker connections](https://cloud.tencent.com/developer/article/1707044) * [Things about SSL/TLS (Part 11) - Certificate operations](https://medium.com/@clu1022/%E9%82%A3%E4%BA%9B%E9%97%9C%E6%96%BCssl-tls%E7%9A%84%E4%BA%8C%E4%B8%89%E4%BA%8B-%E5%8D%81%E4%B8%80-%E6%86%91%E8%AD%89%E7%94%B3%E8%AB%8B%E5%AF%A6%E4%BD%9C%E7%AF%87-903834f1ac5f) --- ## About this article and its author Originally published on [Mark Ku's Tech Notes](https://blog.markkulab.net/en/post/prevent-docker-worm-remote-management-attacks) License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — when reusing or quoting, credit the author and link back to the original ### About the author **[Mark Ku](https://blog.markkulab.net/en/author/mark-ku)** — Software Solution Provider - 10+ years senior software engineer, now an AI Builder - Focused on large-platform architecture — North-American e-commerce, AI SaaS subscription billing - Combining AI Agents and automation to build evolvable product foundations ### Free tools built by the author All of these are free to use: - [Free PDF Sign Tool](https://blog.markkulab.net/en/tools/pdf-sign): Online PDF sign tool — draw, type, or upload a signature, then drag, resize, and download. Everything runs in your browser; nothing is uploaded. - [VS Code Refactory](https://blog.markkulab.net/en/tools/refactory): Refactory is a VS Code refactoring extension: 34 actions plus a 37-rule code-smell inspection layer with a Code Health dashboard, across 18 languages, backed by 534 tests. It learns your repo's conventions: where interfaces live, where DI is registered, whether 'use client' belongs. It ranks files by git churn × complexity so you know what to fix first, and hands any smell to the Claude Code already on your machine. Free to use, and your source never leaves your computer. - [DB-Kit Database Manager](https://blog.markkulab.net/en/tools/db-kit): DB-Kit is a lightweight, cross-platform database manager built with Tauri + Rust + React. Manage MySQL, MariaDB, PostgreSQL, SQL Server, Oracle, SQLite, MongoDB, Redis, Kafka, Elasticsearch and RabbitMQ from one consistent interface: passwords encrypted in the OS keychain, SSH tunnels, full CRUD, a visual query builder, stacked multi-statement result sets, cross-connection data transfer and compare/sync, Excel / CSV import & export, visualized execution plans, ER diagrams, scheduled backups, SQL stress testing with p50–p99 latency percentiles, a 15-rule SQL review engine, Kafka message browsing with monitoring & alerts, a bilingual UI (Traditional Chinese / English), a built-in AI assistant (natural-language SQL, AI review and tuning advice) and the dbk CLI. Free and open source (MIT), with installers for Windows, macOS and Linux. - [VS Code Super Mermaid](https://blog.markkulab.net/en/tools/super-mermaid): Super Mermaid is a VS Code extension for beautiful Mermaid diagrams out of the box: auto-colored live preview, mouse pan & zoom, high-res PNG / SVG export, 21 templates and multiple themes. Free and open source (MIT). - [React Super Mermaid](https://blog.markkulab.net/en/tools/react-super-mermaid): react-super-mermaid is an open-source React component library: render beautiful Mermaid diagrams with a single , with built-in colorful / sketch themes, pan & zoom, in-diagram search, and high-res SVG / PNG export. Lightweight, SSR-safe, fully typed. Free and open source (MIT). - [Jira / Confluence Super Mermaid](https://blog.markkulab.net/en/tools/jira-super-mermaid): An Atlassian Forge app: write Mermaid syntax directly inside a Jira issue or a Confluence page and get flowcharts, sequence diagrams, state machines and Gantt charts. 11 diagram types, SVG / PNG export, light and dark themes, full CJK support. Runs on Atlassian: your diagrams live in your own site and the app calls no third-party service. Free, coming soon to the Atlassian Marketplace. - [Mermaid Live Preview](https://blog.markkulab.net/en/tools/mermaid-preview): Write Mermaid in your browser, see it render instantly, and share the whole diagram as a single link. No sign-up, nothing uploaded to a server, and mermaid.live share links work as-is. - [React Intl Phone Number](https://blog.markkulab.net/en/tools/react-intl-phone-number): react-intl-phone-number is an open-source React component: framework-agnostic and antd-free, with E.164 in/out, a searchable flag / country-code dropdown, configurable validation levels (strict / mobile-strict / loose), themeable CSS, and i18n — phone logic powered by google-libphonenumber. Lightweight and fully typed. Free and open source (MIT). - [Uptime Kuma Cluster](https://blog.markkulab.net/en/tools/uptime-kuma-cluster): Turn single-node Uptime Kuma into a highly available cluster: OpenResty + Lua smart load balancing, shared MariaDB state, health checks and automatic failover, plus cluster-management REST APIs. One Docker Compose command to start. Free and open source (MIT). - [Special Education](https://blog.markkulab.net/en/education): Learning materials crafted for special education students ### Daily podcasts - [Mark's Tech Insights — Daily AI News](https://blog.markkulab.net/en/category/tech-news): Daily curated AI and tech trends. Catch the latest developments via audio summaries — covering AI applications, software architecture, DevOps, and engineering practice. — RSS: https://blog.markkulab.net/feed.xml - [AI股市蝦聊](https://blog.markkulab.net/en/category/ai-stock-chat): Every trading day, an AI-analyzed take on the Taiwan stock market, delivered as a two-host conversation covering the session and the next-day outlook. — RSS: https://blog.markkulab.net/ai-stock-chat/feed.xml - [開源好物週報](https://blog.markkulab.net/en/category/open-source-weekly): A weekly two-host pick of free open-source tools surfaced from real Hacker News, GitHub, and Reddit buzz — what pain they solve and the fastest way to get started. — RSS: https://blog.markkulab.net/open-source-weekly/feed.xml ### Newsletter [Subscribe to the newsletter](https://blog.markkulab.net/en/subscribe) — Be the first to know about new posts. No spam, unsubscribe anytime.