According to quick search on Shodan there are 3813 docker instances with exposed API responding on default port. I guess owners has to be on lookout https://threatpost.com/misconfigured-docker-servers-xanthe-malware/161732/