The Docker API, and whether anyone can use it.
A Docker daemon listening on TCP 2375 without TLS gives whoever reaches it control of the host: run any container, read any file. Tillarr asks /version, reads the engine's version, and never sends anything else.
If it answers, Tillarr reads Unprotected wherever it is, at home too, and says what to do.
What you see
- Whether it answers, how quickly, and which address answered
- Its version, read without a key
- A warning whenever it answers without a sign-in, with what to do
Connect Docker API
What to have ready when you add it in Tillarr.
- Its address. Usually http://your-server:2375. Add a remote address too, and Tillarr uses it when home doesn't answer.
- Nothing else. Watching needs no key and no login, so it's free and can't change anything in Docker API.
Good to know
- Use TLS with client certificates on 2376, which Tillarr can't open without a certificate and so never flags.
- For read-only access, put a socket proxy in front that allows reads only. To manage containers from Tillarr, use Portainer.
Behind a sign-in page
If a sign-in page guards Docker API, let /version through so the check can reach it. The remote access guide shows how.
How Tillarr checks Docker API
Without a key, Tillarr asks for /version to see that Docker API is up, and reads its version from the answer. Every request goes from your device straight to your server, never through us.
Questions
Can Tillarr start and stop containers through the Docker API?
No. Tillarr never sends commands to a bare Docker API; connect Portainer for that.
Why is my Docker API Unprotected at home?
Because anyone on your network, or any container on it, can take over the host through it.