Docker containers seem to restart endless

[felixKroni]

Hi, Im new to this whole thing but I got the newest tpot version installed on debian 12 and the docker container start when i start the server but it seems like they shutdown after some time. I can get to the Menu at https://:64297 and also open the map even if its empty but i cant access /kibana or /spiderfoot or any other service.

I tried get info about the containers using dps.sh from the docu but i cant find that file. Did it got removes in this version?
I tried to look at the containers using docker ps and docker ps -a

Sometimes there are a lot running:

and sometimes only one is running:

Ive seen in other discussions from last year that ddosspot could be the problem but i dont know how to remove it from the tpot.yml and if that is even a thing anymore.

Thanks for your help

[felixKroni]

Some more information i gathered yesterday:
the tpotinit container restarts every 60sec like defined in the docker-compose. At this point every container gets started but there is no memory overflow as far as i can see it gets to a max usage of 5GB before it all goes down again after about 8sec.

Sometimes i noticed that they were up longer for like 30sec but thats it and all shuts down again.
The commands in htop change though:

In this small period of time before the containers get deleted i looked at some of the docker logs but there is nothing like an error or something
Suricata:

Cowrie:

Elasticsearch:

[felixKroni]

newsflash, it might be a memory problem...
Ive created a custom docker-compose only containing some containers and i get a lot of exit code 137 indicating that the system ran out of memory:

Although i have no clue why there is a "User-initiated shutdown"

[barrydekong]

Hi, I have the same issue even though I reinstalled and update the Tpot again! Anyone can help! thanks.

[felixKroni]

I have solved it for myself by using the ubuntu iso that is provided. That worked pretty straightforward without any Problem. I still have no clue what the problem was using Debian.

[barrydekong]

Thank you!

[FloppyDucks]

I think i know ur issue, glad its working , im pretty sure it is related to the ports that the docker compose file uses when setting up the TPOT, you need to change the default docker compose because a few services use the same ports like 443 and a few others

[barrydekong]

Thank you for your information! I have installed Ubuntu with the same issue and have followed your suggestion to edit the docker-compose.yml file but no clue to change the default setting. Grateful if you can guild how to resolve docker compose file, many thanks.

[RytterMohn]

hello! I think i know how to solve this problem.
That's because the ports has been used.
On Debian,port 631 are allocated to 'cups-brow server'.

I use

sudo journalctl -u docker -f

to see what happened to the docker.
And I found the port 631 has been allocated，that's why the docker containers restart endless.
I use

sudo lsof -i :631

found 'cups server' are using 631 port.
so i use

sudo systemctl stop cups

to stop 'cups server'
and then use

systemctl start tpot

to start tpot.
You will see the tpot run normally

(I am not native English speaker, please excuse my poor English)

[RytterMohn]

I use debian system and use ./install.sh to install tpot.It works on my machine. if your docker still restart endless,maybe other port have problem(Sometimes port 19 will be allocated to other server)

[barrydekong]

It works, thank you for your information!

[zaterio]

After a fresh install of Debian 12 and tpot in sensor mode, containers kept restarting, which was due to the WEB_USER variable not being configured in the .env, after adding a dummy value and restarting, the problem was solved

docker compose -f  docker-compose.yml up

tpotinit             | 
tpotinit             | # Updating permissions ...
tpotinit             | 
tpotinit             | chmod: /data/nginx/conf: No such file or directory
tpotinit             | chmod: /data/nginx/cert: No such file or directory
tpotinit             | 
tpotinit             | # Checking if OSType is set correctly.
tpotinit             | 
tpotinit             | # Error: WEB_USER is not set or empty. Please check T-Pot .env config.
tpotinit             | 
tpotinit             | # Aborting

[t3chn0m4g3]

Interesting, this check should only happen if installation is set to Hive.

Is it possible you used the sensor.yml but did not adjust .env to sensor mode (the deploy script usually takes care if this when run).

tpotce/docker/tpotinit/dist/entrypoint.sh

Line 223 in 175e194

if [ "${TPOT_TYPE}" == "HIVE" ];