Support Dicom legacy port on tcp/104

tweaking nginx, ddospot:
- Remove ddospot from standard - Add ddospot only to tarpit - Decouple nginx from host mode, only export tcp/64297, tcp/64294 - Adjust editions accordingly - Keep LUA settings in Nginx config for now, just in case we find a different use case
2025-10-13 20:09:13 +00:00 · 2024-12-09 17:58:52 +01:00 · 2024-12-09 17:38:25 +01:00
11 changed files with 143 additions and 128 deletions
--- a/compose/llm.yml
+++ b/compose/llm.yml
@ -2,7 +2,7 @@
 networks:
  beelzebub_local:
  galah_local:
-  spiderfoot_local:
+  nginx_local:
  ewsposter_local:

 services:
@ -165,6 +165,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - bootstrap.memory_lock=true
     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
@ -193,6 +195,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    mem_limit: 1g
    ports:
     - "127.0.0.1:64296:5601"
@ -206,6 +210,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - LS_JAVA_OPTS=-Xms1024m -Xmx1024m
     - TPOT_TYPE=${TPOT_TYPE:-HIVE}
@ -227,6 +233,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    stop_signal: SIGKILL
    tty: true
    image: ${TPOT_REPO}/redis:${TPOT_VERSION}
@ -240,6 +248,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - MAP_COMMAND=AttackMapServer.py
    stop_signal: SIGKILL
@ -256,6 +266,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - MAP_COMMAND=DataServer_v2.py
     - TPOT_ATTACKMAP_TEXT=${TPOT_ATTACKMAP_TEXT}
@ -307,9 +319,11 @@ services:
     - /var/tmp/nginx/scgi
     - /run
     - /var/lib/nginx/tmp:uid=100,gid=82
-    network_mode: "host"
+    networks:
+     - nginx_local
    ports:
     - "64297:64297"
+     - "64294:64294"
    image: ${TPOT_REPO}/nginx:${TPOT_VERSION}
    pull_policy: ${TPOT_PULL_POLICY}
    read_only: true
@ -327,7 +341,7 @@ services:
      tpotinit:
        condition: service_healthy
    networks:
-     - spiderfoot_local
+     - nginx_local
    ports:
     - "127.0.0.1:64303:8080"
    image: ${TPOT_REPO}/spiderfoot:${TPOT_VERSION}
--- a/compose/mac_win.yml
+++ b/compose/mac_win.yml
@ -4,7 +4,6 @@ networks:
  adbhoney_local:
  ciscoasa_local:
  cowrie_local:
-  ddospot_local:
  dicompot_local:
  dionaea_local:
  elasticpot_local:
@ -135,29 +134,6 @@ services:
      - ${TPOT_DATA_PATH}/cowrie/log:/home/cowrie/cowrie/log
      - ${TPOT_DATA_PATH}/cowrie/log/tty:/home/cowrie/cowrie/log/tty

-# Ddospot service
-  ddospot:
-    container_name: ddospot
-    restart: always
-    depends_on:
-      tpotinit:
-        condition: service_healthy
-    networks:
-     - ddospot_local
-    ports:
-     - "19:19/udp"
-#     - "53:53/udp"
-     - "123:123/udp"
-#     - "161:161/udp"
-     - "1900:1900/udp"
-    image: ${TPOT_REPO}/ddospot:${TPOT_VERSION}
-    pull_policy: ${TPOT_PULL_POLICY}
-    read_only: true
-    volumes:
-     - ${TPOT_DATA_PATH}/ddospot/log:/opt/ddospot/ddospot/logs
-     - ${TPOT_DATA_PATH}/ddospot/bl:/opt/ddospot/ddospot/bl
-     - ${TPOT_DATA_PATH}/ddospot/db:/opt/ddospot/ddospot/db
-
 # Dicompot service
 # Get the Horos Client for testing: https://horosproject.org/
 # Get Dicom images (CC BY 3.0): https://www.cancerimagingarchive.net/collections/
@ -171,6 +147,7 @@ services:
    networks:
     - dicompot_local
    ports:
+     - "104:11112"
     - "11112:11112"
    image: ${TPOT_REPO}/dicompot:${TPOT_VERSION}
    pull_policy: ${TPOT_PULL_POLICY}
--- a/compose/mini.yml
+++ b/compose/mini.yml
@ -9,7 +9,7 @@ networks:
  dicompot_local:
  honeypots_local:
  medpot_local:
-  spiderfoot_local:
+  nginx_local:
  ewsposter_local:

 services:
@ -199,6 +199,7 @@ services:
    networks:
     - dicompot_local
    ports:
+     - "104:11112"
     - "11112:11112"
    image: ${TPOT_REPO}/dicompot:${TPOT_VERSION}
    pull_policy: ${TPOT_PULL_POLICY}
@ -364,6 +365,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - bootstrap.memory_lock=true
     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
@ -392,6 +395,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    mem_limit: 1g
    ports:
     - "127.0.0.1:64296:5601"
@ -405,6 +410,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - LS_JAVA_OPTS=-Xms1024m -Xmx1024m
     - TPOT_TYPE=${TPOT_TYPE:-HIVE}
@ -426,6 +433,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    stop_signal: SIGKILL
    tty: true
    image: ${TPOT_REPO}/redis:${TPOT_VERSION}
@ -439,6 +448,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - MAP_COMMAND=AttackMapServer.py
    stop_signal: SIGKILL
@ -455,6 +466,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - MAP_COMMAND=DataServer_v2.py
     - TPOT_ATTACKMAP_TEXT=${TPOT_ATTACKMAP_TEXT}
@ -506,9 +519,11 @@ services:
     - /var/tmp/nginx/scgi
     - /run
     - /var/lib/nginx/tmp:uid=100,gid=82
-    network_mode: "host"
+    networks:
+     - nginx_local
    ports:
     - "64297:64297"
+     - "64294:64294"
    image: ${TPOT_REPO}/nginx:${TPOT_VERSION}
    pull_policy: ${TPOT_PULL_POLICY}
    read_only: true
@ -526,7 +541,7 @@ services:
      tpotinit:
        condition: service_healthy
    networks:
-     - spiderfoot_local
+     - nginx_local
    ports:
     - "127.0.0.1:64303:8080"
    image: ${TPOT_REPO}/spiderfoot:${TPOT_VERSION}
--- a/compose/mobile.yml
+++ b/compose/mobile.yml
@ -193,6 +193,7 @@ services:
    networks:
     - dicompot_local
    ports:
+     - "104:11112"
     - "11112:11112"
    image: ${TPOT_REPO}/dicompot:${TPOT_VERSION}
    pull_policy: ${TPOT_PULL_POLICY}
--- a/compose/sensor.yml
+++ b/compose/sensor.yml
@ -7,7 +7,6 @@ networks:
  conpot_local_ipmi:
  conpot_local_kamstrup_382:
  cowrie_local:
-  ddospot_local:
  dicompot_local:
  dionaea_local:
  elasticpot_local:
@ -221,29 +220,6 @@ services:
      - ${TPOT_DATA_PATH}/cowrie/log:/home/cowrie/cowrie/log
      - ${TPOT_DATA_PATH}/cowrie/log/tty:/home/cowrie/cowrie/log/tty

-# Ddospot service
-  ddospot:
-    container_name: ddospot
-    restart: always
-    depends_on:
-      tpotinit:
-        condition: service_healthy
-    networks:
-     - ddospot_local
-    ports:
-     - "19:19/udp"
-     - "53:53/udp"
-     - "123:123/udp"
-#     - "161:161/udp"
-     - "1900:1900/udp"
-    image: ${TPOT_REPO}/ddospot:${TPOT_VERSION}
-    pull_policy: ${TPOT_PULL_POLICY}
-    read_only: true
-    volumes:
-     - ${TPOT_DATA_PATH}/ddospot/log:/opt/ddospot/ddospot/logs
-     - ${TPOT_DATA_PATH}/ddospot/bl:/opt/ddospot/ddospot/bl
-     - ${TPOT_DATA_PATH}/ddospot/db:/opt/ddospot/ddospot/db
-
 # Dicompot service
 # Get the Horos Client for testing: https://horosproject.org/
 # Get Dicom images (CC BY 3.0): https://www.cancerimagingarchive.net/collections/
@ -257,6 +233,7 @@ services:
    networks:
     - dicompot_local
    ports:
+     - "104:11112"
     - "11112:11112"
    image: ${TPOT_REPO}/dicompot:${TPOT_VERSION}
    pull_policy: ${TPOT_PULL_POLICY}
--- a/compose/standard.yml
+++ b/compose/standard.yml
@ -7,7 +7,6 @@ networks:
  conpot_local_ipmi:
  conpot_local_kamstrup_382:
  cowrie_local:
-  ddospot_local:
  dicompot_local:
  dionaea_local:
  elasticpot_local:
@ -21,8 +20,8 @@ networks:
  redishoneypot_local:
  sentrypeer_local:
  tanner_local:
-  spiderfoot_local:
  wordpot_local:
+  nginx_local:
  ewsposter_local:

 services:
@ -223,29 +222,6 @@ services:
      - ${TPOT_DATA_PATH}/cowrie/log:/home/cowrie/cowrie/log
      - ${TPOT_DATA_PATH}/cowrie/log/tty:/home/cowrie/cowrie/log/tty

-# Ddospot service
-  ddospot:
-    container_name: ddospot
-    restart: always
-    depends_on:
-      tpotinit:
-        condition: service_healthy
-    networks:
-     - ddospot_local
-    ports:
-     - "19:19/udp"
-     - "53:53/udp"
-     - "123:123/udp"
-#     - "161:161/udp"
-     - "1900:1900/udp"
-    image: ${TPOT_REPO}/ddospot:${TPOT_VERSION}
-    pull_policy: ${TPOT_PULL_POLICY}
-    read_only: true
-    volumes:
-     - ${TPOT_DATA_PATH}/ddospot/log:/opt/ddospot/ddospot/logs
-     - ${TPOT_DATA_PATH}/ddospot/bl:/opt/ddospot/ddospot/bl
-     - ${TPOT_DATA_PATH}/ddospot/db:/opt/ddospot/ddospot/db
-
 # Dicompot service
 # Get the Horos Client for testing: https://horosproject.org/
 # Get Dicom images (CC BY 3.0): https://www.cancerimagingarchive.net/collections/
@ -259,6 +235,7 @@ services:
    networks:
     - dicompot_local
    ports:
+     - "104:11112"
     - "11112:11112"
    image: ${TPOT_REPO}/dicompot:${TPOT_VERSION}
    pull_policy: ${TPOT_PULL_POLICY}
@ -335,7 +312,7 @@ services:
    networks:
     - h0neytr4p_local
    ports:
-      - "443:443"
+     - "443:443"
    # - "80:80"
    image: ${TPOT_REPO}/h0neytr4p:${TPOT_VERSION}
    pull_policy: ${TPOT_PULL_POLICY}
@ -694,6 +671,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - bootstrap.memory_lock=true
     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
@ -722,6 +701,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    mem_limit: 1g
    ports:
     - "127.0.0.1:64296:5601"
@ -735,6 +716,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - LS_JAVA_OPTS=-Xms1024m -Xmx1024m
     - TPOT_TYPE=${TPOT_TYPE:-HIVE}
@ -756,6 +739,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    stop_signal: SIGKILL
    tty: true
    image: ${TPOT_REPO}/redis:${TPOT_VERSION}
@ -769,6 +754,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - MAP_COMMAND=AttackMapServer.py
    stop_signal: SIGKILL
@ -785,6 +772,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - MAP_COMMAND=DataServer_v2.py
     - TPOT_ATTACKMAP_TEXT=${TPOT_ATTACKMAP_TEXT}
@ -836,9 +825,11 @@ services:
     - /var/tmp/nginx/scgi
     - /run
     - /var/lib/nginx/tmp:uid=100,gid=82
-    network_mode: "host"
+    networks:
+     - nginx_local
    ports:
     - "64297:64297"
+     - "64294:64294"
    image: ${TPOT_REPO}/nginx:${TPOT_VERSION}
    pull_policy: ${TPOT_PULL_POLICY}
    read_only: true
@ -856,7 +847,7 @@ services:
      tpotinit:
        condition: service_healthy
    networks:
-     - spiderfoot_local
+     - nginx_local
    ports:
     - "127.0.0.1:64303:8080"
    image: ${TPOT_REPO}/spiderfoot:${TPOT_VERSION}
--- a/compose/tarpit.yml
+++ b/compose/tarpit.yml
@ -1,10 +1,11 @@
 # T-Pot: TARPIT
 networks:
+  ddospot_local:
  endlessh_local:
  go-pot_local:
  hellpot_local:
  heralding_local:
-  spiderfoot_local:
+  nginx_local:
  ewsposter_local:

 services:
@ -41,6 +42,29 @@ services:
 #### Honeypots
 ##################

+# Ddospot service
+  ddospot:
+    container_name: ddospot
+    restart: always
+    depends_on:
+      tpotinit:
+        condition: service_healthy
+    networks:
+     - ddospot_local
+    ports:
+     - "19:19/udp"
+     - "53:53/udp"
+     - "123:123/udp"
+#     - "161:161/udp"
+     - "1900:1900/udp"
+    image: ${TPOT_REPO}/ddospot:${TPOT_VERSION}
+    pull_policy: ${TPOT_PULL_POLICY}
+    read_only: true
+    volumes:
+     - ${TPOT_DATA_PATH}/ddospot/log:/opt/ddospot/ddospot/logs
+     - ${TPOT_DATA_PATH}/ddospot/bl:/opt/ddospot/ddospot/bl
+     - ${TPOT_DATA_PATH}/ddospot/db:/opt/ddospot/ddospot/db
+
 # Endlessh service
  endlessh:
    container_name: endlessh
@ -197,6 +221,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - bootstrap.memory_lock=true
     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
@ -225,6 +251,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    mem_limit: 1g
    ports:
     - "127.0.0.1:64296:5601"
@ -238,6 +266,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - LS_JAVA_OPTS=-Xms1024m -Xmx1024m
     - TPOT_TYPE=${TPOT_TYPE:-HIVE}
@ -259,6 +289,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    stop_signal: SIGKILL
    tty: true
    image: ${TPOT_REPO}/redis:${TPOT_VERSION}
@ -272,6 +304,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - MAP_COMMAND=AttackMapServer.py
    stop_signal: SIGKILL
@ -288,6 +322,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - MAP_COMMAND=DataServer_v2.py
     - TPOT_ATTACKMAP_TEXT=${TPOT_ATTACKMAP_TEXT}
@ -339,9 +375,11 @@ services:
     - /var/tmp/nginx/scgi
     - /run
     - /var/lib/nginx/tmp:uid=100,gid=82
-    network_mode: "host"
+    networks:
+     - nginx_local
    ports:
     - "64297:64297"
+     - "64294:64294"
    image: ${TPOT_REPO}/nginx:${TPOT_VERSION}
    pull_policy: ${TPOT_PULL_POLICY}
    read_only: true
@ -359,7 +397,7 @@ services:
      tpotinit:
        condition: service_healthy
    networks:
-     - spiderfoot_local
+     - nginx_local
    ports:
     - "127.0.0.1:64303:8080"
    image: ${TPOT_REPO}/spiderfoot:${TPOT_VERSION}
--- a/compose/tpot_services.yml
+++ b/compose/tpot_services.yml
@ -33,7 +33,7 @@ networks:
  sentrypeer_local:
  tanner_local:
  wordpot_local:
-  spiderfoot_local:
+  nginx_local:
  ewsposter_local:

 services:
@ -314,6 +314,7 @@ services:
    networks:
     - dicompot_local
    ports:
+     - "104:11112"
     - "11112:11112"
    image: ${TPOT_REPO}/dicompot:${TPOT_VERSION}
    pull_policy: ${TPOT_PULL_POLICY}
@ -925,6 +926,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - bootstrap.memory_lock=true
     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
@ -953,6 +956,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    mem_limit: 1g
    ports:
     - "127.0.0.1:64296:5601"
@ -966,6 +971,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - LS_JAVA_OPTS=-Xms1024m -Xmx1024m
     - TPOT_TYPE=${TPOT_TYPE:-HIVE}
@ -987,6 +994,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    stop_signal: SIGKILL
    tty: true
    image: ${TPOT_REPO}/redis:${TPOT_VERSION}
@ -1000,6 +1009,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - MAP_COMMAND=AttackMapServer.py
    stop_signal: SIGKILL
@ -1016,6 +1027,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - MAP_COMMAND=DataServer_v2.py
     - TPOT_ATTACKMAP_TEXT=${TPOT_ATTACKMAP_TEXT}
@ -1067,9 +1080,11 @@ services:
     - /var/tmp/nginx/scgi
     - /run
     - /var/lib/nginx/tmp:uid=100,gid=82
-    network_mode: "host"
+    networks:
+     - nginx_local
    ports:
     - "64297:64297"
+     - "64294:64294"
    image: ${TPOT_REPO}/nginx:${TPOT_VERSION}
    pull_policy: ${TPOT_PULL_POLICY}
    read_only: true
@ -1087,7 +1102,7 @@ services:
      tpotinit:
        condition: service_healthy
    networks:
-     - spiderfoot_local
+     - nginx_local
    ports:
     - "127.0.0.1:64303:8080"
    image: ${TPOT_REPO}/spiderfoot:${TPOT_VERSION}
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -7,7 +7,6 @@ networks:
  conpot_local_ipmi:
  conpot_local_kamstrup_382:
  cowrie_local:
-  ddospot_local:
  dicompot_local:
  dionaea_local:
  elasticpot_local:
@ -21,8 +20,8 @@ networks:
  redishoneypot_local:
  sentrypeer_local:
  tanner_local:
-  spiderfoot_local:
  wordpot_local:
+  nginx_local:
  ewsposter_local:

 services:
@ -223,29 +222,6 @@ services:
      - ${TPOT_DATA_PATH}/cowrie/log:/home/cowrie/cowrie/log
      - ${TPOT_DATA_PATH}/cowrie/log/tty:/home/cowrie/cowrie/log/tty

-# Ddospot service
-  ddospot:
-    container_name: ddospot
-    restart: always
-    depends_on:
-      tpotinit:
-        condition: service_healthy
-    networks:
-     - ddospot_local
-    ports:
-     - "19:19/udp"
-     - "53:53/udp"
-     - "123:123/udp"
-#     - "161:161/udp"
-     - "1900:1900/udp"
-    image: ${TPOT_REPO}/ddospot:${TPOT_VERSION}
-    pull_policy: ${TPOT_PULL_POLICY}
-    read_only: true
-    volumes:
-     - ${TPOT_DATA_PATH}/ddospot/log:/opt/ddospot/ddospot/logs
-     - ${TPOT_DATA_PATH}/ddospot/bl:/opt/ddospot/ddospot/bl
-     - ${TPOT_DATA_PATH}/ddospot/db:/opt/ddospot/ddospot/db
-
 # Dicompot service
 # Get the Horos Client for testing: https://horosproject.org/
 # Get Dicom images (CC BY 3.0): https://www.cancerimagingarchive.net/collections/
@ -259,6 +235,7 @@ services:
    networks:
     - dicompot_local
    ports:
+     - "104:11112"
     - "11112:11112"
    image: ${TPOT_REPO}/dicompot:${TPOT_VERSION}
    pull_policy: ${TPOT_PULL_POLICY}
@ -335,7 +312,7 @@ services:
    networks:
     - h0neytr4p_local
    ports:
-      - "443:443"
+     - "443:443"
    # - "80:80"
    image: ${TPOT_REPO}/h0neytr4p:${TPOT_VERSION}
    pull_policy: ${TPOT_PULL_POLICY}
@ -435,16 +412,12 @@ services:
 # Mailoney service
  mailoney:
    container_name: mailoney
+    stdin_open: true
+    tty: true
    restart: always
    depends_on:
      tpotinit:
        condition: service_healthy
-    environment:
-     - HPFEEDS_SERVER=
-     - HPFEEDS_IDENT=user
-     - HPFEEDS_SECRET=pass
-     - HPFEEDS_PORT=20000
-     - HPFEEDS_CHANNELPREFIX=prefix
    networks:
     - mailoney_local
    ports:
@ -698,6 +671,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - bootstrap.memory_lock=true
     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
@ -726,6 +701,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    mem_limit: 1g
    ports:
     - "127.0.0.1:64296:5601"
@ -739,6 +716,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - LS_JAVA_OPTS=-Xms1024m -Xmx1024m
     - TPOT_TYPE=${TPOT_TYPE:-HIVE}
@ -760,6 +739,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    stop_signal: SIGKILL
    tty: true
    image: ${TPOT_REPO}/redis:${TPOT_VERSION}
@ -773,6 +754,8 @@ services:
    depends_on:
      tpotinit:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - MAP_COMMAND=AttackMapServer.py
    stop_signal: SIGKILL
@ -789,6 +772,8 @@ services:
    depends_on:
      elasticsearch:
        condition: service_healthy
+    networks:
+     - nginx_local
    environment:
     - MAP_COMMAND=DataServer_v2.py
     - TPOT_ATTACKMAP_TEXT=${TPOT_ATTACKMAP_TEXT}
@ -840,9 +825,11 @@ services:
     - /var/tmp/nginx/scgi
     - /run
     - /var/lib/nginx/tmp:uid=100,gid=82
-    network_mode: "host"
+    networks:
+     - nginx_local
    ports:
     - "64297:64297"
+     - "64294:64294"
    image: ${TPOT_REPO}/nginx:${TPOT_VERSION}
    pull_policy: ${TPOT_PULL_POLICY}
    read_only: true
@ -860,7 +847,7 @@ services:
      tpotinit:
        condition: service_healthy
    networks:
-     - spiderfoot_local
+     - nginx_local
    ports:
     - "127.0.0.1:64303:8080"
    image: ${TPOT_REPO}/spiderfoot:${TPOT_VERSION}
--- a/docker/nginx/dist/conf/lsweb.conf
+++ b/docker/nginx/dist/conf/lsweb.conf
@ -101,7 +101,7 @@ server {
            if tpot_ostype == "mac" or tpot_ostype == "win" then
                return "http://logstash:64305";
            else
-                return "http://127.0.0.1:64305";
+                return "http://logstash:64305";
            end
        }
        access_log off;
--- a/docker/nginx/dist/conf/tpotweb.conf
+++ b/docker/nginx/dist/conf/tpotweb.conf
@ -128,7 +128,7 @@ server {
            if tpot_ostype == "mac" or tpot_ostype == "win" then
                return "http://kibana:5601";
            else
-                return "http://127.0.0.1:64296";
+                return "http://kibana:5601";
            end
        }
        proxy_pass $kibana;
@ -142,7 +142,7 @@ server {
            if tpot_ostype == "mac" or tpot_ostype == "win" then
                return "http://elasticsearch:9200";
            else
-                return "http://127.0.0.1:64298";
+                return "http://elasticsearch:9200";
            end
        }

@ -157,7 +157,7 @@ server {
            if tpot_ostype == "mac" or tpot_ostype == "win" then
                return "http://map_web:64299";
            else
-                return "http://127.0.0.1:64299";
+                return "http://map_web:64299";
            end
        }
        proxy_pass $map_web;
@ -175,7 +175,7 @@ server {
            if tpot_ostype == "mac" or tpot_ostype == "win" then
                return "http://map_web:64299";
            else
-                return "http://127.0.0.1:64299";
+                return "http://map_web:64299";
            end
        }
        proxy_pass $map_web;
@ -193,7 +193,7 @@ server {
            if tpot_ostype == "mac" or tpot_ostype == "win" then
                return "http://spiderfoot:8080";
            else
-                return "http://127.0.0.1:64303";
+                return "http://spiderfoot:8080";
            end
        }
    location /spiderfoot/ {