What it is
Orchestration ports: Docker API, Kubernetes API, Kubelet.
Why it is risky
An unauthenticated Docker API (2375) is effectively root on the host — the worst possible exposure.
What to do
Never publish the API; enforce TLS·mutual-auth·RBAC and keep it on internal networks.
Is it listening on your server?
Linux
ss -ltnp 'sport = :6443'Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.