I need help to put kali linux and metasploit2 in a docker-compose.yml file.

I followed this medium tutorial: https://medium.com/@habibsemouma/setting-up-metasploitable2-and-kali-in-docker-for-pentesting-6b71a089c4a2

So basically:

docker network create pentest
docker run --network=pentest -h victim -it --rm --name metasploitable2 tleemcjr/metasploitable2
docker run --network=pentest -h attacker -it --rm --name kalibox kalilinux/kali-rolling

Then on the attacker container:

apt update
apt install net-tools
apt install nmap

Then get the ip address of both container launching ifconfig and try to get open ports in victim container:

nmap -F 172.18.0.3 (of course IP Address different)

And like in the tutorial I got something like this:

Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-11 17:46 UTC
Nmap scan report for metasploitable2.pentest (172.18.0.3)
Host is up (0.000011s latency).
Not shown: 84 closed tcp ports (reset)
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
23/tcp   open  telnet
25/tcp   open  smtp
80/tcp   open  http
111/tcp  open  rpcbind
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
513/tcp  open  login
514/tcp  open  shell
2121/tcp open  ccproxy-ftp
3306/tcp open  mysql
5432/tcp open  postgresql
5900/tcp open  vnc
6000/tcp open  X11
8009/tcp open  ajp13
MAC Address: 02:42:AC:12:00:03 (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds

So everything’s fine.

Then, I decided to put everything togheter with a docker-compose.yml file:

version: '3.1'

services:

  metasploitable2:
    image: tleemcjr/metasploitable2
    container_name: victim
    volumes:
      - $PWD/work/metasploitable2:/work    
    networks:
      parrotLan:
        ipv4_address: 172.16.0.103
    restart: always
    privileged: true
    working_dir: /work
    stdin_open: true
    tty: true
    command: /bin/bash        
        
  kali:
    image: kalilinux/kali-rolling
    container_name: attacker
    volumes:
      - $PWD/work/kali:/work    
    networks:
      parrotLan:
        ipv4_address: 172.16.0.104
    restart: always
    privileged: true
    working_dir: /work
    stdin_open: true
    tty: true
    command: /bin/bash        

        
networks:
  parrotLan:
    ipam:
      config:
        - subnet: 172.16.0.0/24

I executed bash on the running containers in different Terminals:

 docker exec -it attacker /bin/bash
 docker exec -it victim /bin/bash

Both containers start nicely, I do the same configurations things as above, and I can ping nicely container victim from the container attacker, but when I launch (from the attacker):

nmap -F 172.16.0.103 

I got something like all ports are closed:

Starting Nmap 7.92 ( https://nmap.org ) at 2024-07-02 09:32 UTC
Nmap scan report for victim (172.16.0.103)
Host is up (0.000018s latency).
rDNS record for 172.16.0.103: victim.parrot_parrotLan
All 100 scanned ports on victim (172.16.0.103) are in ignored states.
Not shown: 100 closed tcp ports (reset)
MAC Address: 02:42:AC:10:00:67 (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 0.25 seconds

I think the problem is in the ports (maybe I have to open explicitely ?), but what drive me crazy is that I didn’t find any example of a docker-compose.yml file about this possible configuration, so I basically start to think there are some serious motivations about not to use docker-compose.yml

Thanks for any help.

BTW I read about using network: host as a solution to do not open port one by one, but I don’t really want to publish on my LAN these containers.