--- title: "Docker Tips: Access the Docker daemon via ssh" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/docker-tips-access-the-docker-daemon-via-ssh/" --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Docker Tips: Access the Docker daemon via ssh By [Luc Juggery](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/luc-juggery/) on Mar 27, 2019 • 4 min read Docker 18.09 offers the possibility for a Docker client to communicate with a remote daemon via ssh. Here’s how: ![Terminal showing `docker -H ssh://vagrant@192.168.5.178 run -ti alpine`, illustrating remote Docker daemon communication via](/app/uploads/2019/03/1_46kC94dk-JAHQsd29JrBrA.png) ## Client / Server communications The Docker client communicates usually with the daemon either locally, via the unix socket */var/run/docker.sock*, or over a network via a tcp socket. Below is a typical example of options provided to the Docker daemon at startup. ``` `$ ps aux | grep dockerd root 2900 0.1 4.4 388008 45424 ? Sl 09:28 0:01 /usr/local/bin/dockerd -g /var/lib/docker -H unix:// -H tcp://0.0.0.0:2376 --label provider=virtualbox --tlsverify --tlscacert=/var/lib/boot2docker/ca.pem --tlscert=/var/lib/boot2docker/server.pem --tlskey=/var/lib/boot2docker/server-key.pem --storage-driver aufs` ``` There are 2 important flags related to the client / server communication here: - *-H unix://,*refers to the local unix socket */var/run/docker.sock*. Locally, the Docker client uses this socket to communicate with the daemon - *-H tcp://0.0.0.0:2376* makes the daemon available via any network interface on port 2376. This port needs to be opened in the security groups (and restricted to a white list of IP addresses if possible) so a remote client can access the daemon. As ssh is widely used and is often one of the protocols allowed by default, it could be convenient to access the Docker daemon directly via ssh. Docker 18.09 makes it possible ! Let’s test it.   ## Creation of a VM We will start by creating a new Docker Host and make sure it runs the latest Docker version. We use [Vagrant](http://www.vagrantup.com/), a great tool from [Hashicorp](http://www.hashicorp.com/), to provision and configure a local virtual machine on VirtualBox. In a new folder, we run the following command : ``` `$ vagrant init ubuntu/bionic64` ``` This generates a file called Vagrantfile which defines how the virtual machine should be setup. We modify it a little bit so it looks like the following : ``` `# -*- mode: ruby -*- # vi: set ft=ruby : Vagrant.configure("2") do |config| config.vm.box = "ubuntu/bionic64" # Bridge network configuration config.vm.network "public_network" config.vm.provision "shell", inline: <<-SHELL # Install last version of Docker curl -fsSL http://test.docker.com -o test-docker.sh sh test-docker.sh # helper script installs the beta package # Add default user in docker group usermod -aG docker vagrant SHELL end` ``` Basically, we tell Vagrant to : - create a VM based on Ubuntu Bionic64 - use a bridge network so the VM is accessible from the host - install the latest test build of Docker - add the default *vagrant* user to the *docker* group (no more *sudo* on each command) We can then create the VM with the following command : ``` `$ vagrant up` ``` Once the VM is up, we connect via ssh and check the network interface to get its IP address on the LAN, *192.168.5.178*, in this example. ``` `$ vagrant ssh vagrant@ubuntu-bionic:~$ ip a … 3: enp0s8: mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 08:00:27:75:93:48 brd ff:ff:ff:ff:ff:ff inet 192.168.5.178/24 brd 192.168.5.255 scope global dynamic enp0s8 valid_lft 4242sec preferred_lft 4242sec inet6 fe80::a00:27ff:fe75:9348/64 scope link valid_lft forever preferred_lft forever` ```   ## Access to the daemon over ssh An additional folder *.vagrant* was created during the setup of the VM. This one contains the VM metadata and the private key which allows the default *vagrant* user a passwordless ssh connection. We add this key to the authentication agent with the following command (so we do not have to specify its path each time we use it) : ``` `$ ssh-add -k .vagrant/machines/default/virtualbox/private_key Identity added: .vagrant/machines/default/virtualbox/private_key (.vagrant/machines/default/virtualbox/private_key)` ``` We can now issue Docker commands via ssh using the -H flag followed by the ssh connection string. ``` `$ docker -H ssh://vagrant@192.168.5.178 run -ti alpine echo "hello" Unable to find image 'alpine:latest' locally latest: Pulling from library/alpine 4fe2ade4980c: Pull complete Digest: sha256:621c2f39f8133a3a94dbdf0d5ca81102b9e57c0dc184cadaf5528 Status: Downloaded newer image for alpine:latest hello` ``` Of course, in order to avoid using this flag for each command, the DOCKER_HOST environment variable can be used instead. ``` `$ export DOCKER_HOST=ssh://vagrant@192.168.5.178 $ docker image ls REPOSITORY TAG IMAGE ID CREATED SIZE alpine latest 196d12cf6ab1 4 weeks ago 4.41MB` ``` Note : *alpine* is the only image available on the host, it was downloaded when we run the container. This blog originated from http://medium.com/lucjuggery/docker-tips-access-the-docker-daemon-via-ssh-97cd6b44a53 [Luc Juggery](http://medium.com/@lucjuggery) is a Tigera guest blogger. He is a software engineer with 15+ years of experience in big companies and startups. He has been in the startup ecosystem since 6+ years and co-founder of 2 startups located in Sophia-Antipolis. ————————————————- [**Free Online Training**](https://wordpress-1075849-4005834.cloudwaysapps.com/events/) Access Live and On-Demand Kubernetes Training [**Calico Enterprise – Free Trial**](https://www.calicocloud.io/home) Network Security, Monitoring, and Troubleshooting for Microservices Running on Kubernetes [How-To](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/how-to/)[Open Source](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/open-source/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![AI Assistant for Calico: Troubleshooting at the Speed of Thought](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/Blog-Mar-20-AI-Assistant-for-Calico.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/ai-assistant-for-calico-troubleshooting-at-the-speed-of-thought/) #### [AI Assistant for Calico: Troubleshooting at the Speed of Thought](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/ai-assistant-for-calico-troubleshooting-at-the-speed-of-thought/) By [Veronika Smolik](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/veronika-smolik/) on Mar 19, 2026 Despite the wealth of data available, distilling a coherent narrative from a Kubernetes cluster remains a challenge for modern infrastructure teams. Even with powerful visualization tools like the Policy Board, Service Graph, and specialized dashboards,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/ai-assistant-for-calico-troubleshooting-at-the-speed-of-thought/) [![What Your EKS Flow Logs Aren’t Telling You](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/Blog-Mar-18-What-Your-EKS-Flow-Logs-Arent-Telling-You.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/what-your-eks-flow-logs-arent-telling-you/) #### [What Your EKS Flow Logs Aren’t Telling You](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/what-your-eks-flow-logs-arent-telling-you/) By [Phil DiCorpo](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/phil-dicorpo/) on Mar 18, 2026 If you’re running workloads on Amazon EKS, there’s a good chance you already have some form of network observability in place. VPC Flow Logs have been a staple of AWS networking for years, and AWS... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/what-your-eks-flow-logs-arent-telling-you/) [![Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Kubecon-Euro-2026-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) #### [Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 25, 2026 The cloud-native community is heading to the historic canals and vibrant tech scene of Amsterdam for KubeCon + CloudNativeCon Europe 2026! From March 23–26, Amsterdam will be buzzing with the latest in Kubernetes, platform engineering,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/)