Disclaimer: Before blindly copying & pasting, understand that I am not an expert in T-POT or Docker.  I’m learning this as I go, including Docker. I also have my instances backed up, & fully take the risk of trying things out. Use at your own risk. 

I’m currently running T-POT on a cloud account, after first trying it out on my own device in my home lab. Things are fine most of the time.

However, I kept running into an annoying error. Sometimes T-POT will just shut down on it’s own, well, not exactly.

After about 20 hours of running just fine, I woke up to find it not running.  I started it up again, & the containers would just shut back down.  At first I thought it was a resource issue, the ddospot was getting hammered from various IPs. But I was also getting an error on start up:

				
					Error response from daemon: driver failed programming external connectivity on endpoint snare (d48d029edb2a6c516542c454db0496b9eefe33d19861df2aed626b7ff605a678): Error starting userland proxy: listen tcp4 0.0.0.0:80: bind: address already in use;

After a few minutes of being stubborn & ignoring the error, I decided to search it out. If you’re here, you already know there aren’t a lot of help articles for T-POT & the discussion area is not very active, which is weird considering how awesome this program is. Anyway…I went back to the T-POT docs to see what was supposed to be running  on port 80, & then looked at what was running on it.

				
					sudo lsof -i :80

and got

				
					COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
apache2 782 root 4u IPv6 8800 0t0 TCP *:http (LISTEN)
apache2 785 www-data 4u IPv6 8800 0t0 TCP *:http (LISTEN)
apache2 786 www-data 4u IPv6 8800 0t0 TCP *:http (LISTEN)

It was Apache2. Newman! (kids ask your parents what Seinfeld was). So from the host (In my case Ubuntu 24.04 LTS) I killed Apache2. I mean I didn’t need it anyway. I needed all my necessary ports for T-POT.

				
					sudo service apache2 stop

Checked again, & now nothing was running on port 80.

Then restarted T-POT. This time with no errors & the containers did not shut down.

Hope this helps someone.

T-POT. Threat Intellgence