falco: exclude loopback destinations from miner-pool-port rule

Confirmed 5 false positives over 2026-08-20 to 2026-08-25, all connecting
to ::1:8888 at ~21:3x daily - never a real mining-pool destination since
that's loopback, and every attempt failed instantly (nothing listens on
8888). Couldn't identify the source process (falco loses metadata for it
before it can be captured), but a real miner pool can never be localhost,
so excluding loopback fixes the false-positive class without weakening
the rule for actual remote pool connections.

falco/rules/miner-pool-ports.yaml

@@ -15,11 +15,20 @@
   # removed.
   items: [3333, 3334, 4444, 5555, 5556, 7777, 8888, 9999, 14444]
 
+# Loopback exclusion added 2026-08-25: some unidentified host-level process
+# connects to ::1:8888 roughly once a day (confirmed 5x over 2026-08-20 to
+# 2026-08-25, always ~21:3x, always container=host, always failing instantly
+# since nothing listens on 8888 - falco loses process metadata for it before
+# it can be identified). A real mining pool is by definition a remote
+# server, so loopback destinations can never be genuine pool traffic - this
+# is a false positive in the rule's design (any port 8888 connection, not
+# just remote ones), not a tuned-out exception for a known process.
 - rule: Detect outbound connection to common miner pool port
   desc: Outbound connection to a TCP port commonly used by cryptomining pools.
   condition: >
     outbound and evt.type in (connect, sendto, sendmsg)
     and fd.rport in (miner_pool_ports)
+    and not (fd.rip in ("127.0.0.1", "::1"))
   output: >
     Outbound connection to common miner-pool port
     (user=%user.name command=%proc.cmdline connection=%fd.name

minecraft/docker-compose.yaml

@@ -66,26 +66,46 @@ services:
   #   restart: unless-stopped
   #   mem_limit: 2g
 
-  create:
+  # create:
+  #   image: itzg/minecraft-server:latest
+  #   container_name: minecraft-create
+  #   ports:
+  #     - "55567:25565"
+  #   environment:
+  #     EULA: "true"
+  #     TYPE: "AUTO_CURSEFORGE"
+  #     CF_API_KEY: "${CF_API_KEY}"
+  #     CF_SLUG: "create-olympicjumperl"
+  #     CF_MODPACK_ZIP: "/modpack.zip"
+  #     SERVER_NAME: "Create SMP"
+  #     SEED: "-1307549829135522678"
+  #     MODE: "survival"
+  #     OPS: "Jimcognito,OlympicJumperL"
+  #     ENFORCE_SECURE_PROFILE: "false"
+  #     MEMORY: "4G"
+  #   volumes:
+  #     - /srv/minecraft-create:/data
+  #     - /mnt/nas_projects/Create-OlympicJumperL-2026-08-20.zip:/modpack.zip:ro
+  #   stdin_open: true
+  #   tty: true
+  #   restart: unless-stopped
+  #   mem_limit: 6g
+
+  survival:
     image: itzg/minecraft-server:latest
-    container_name: minecraft-create
+    container_name: minecraft-survival
     ports:
       - "55567:25565"
     environment:
       EULA: "true"
-      TYPE: "AUTO_CURSEFORGE"
+      SERVER_NAME: "Survival SMP"
-      CF_API_KEY: "${CF_API_KEY}"
+      SEED: "-1102400853764765851"
-      CF_SLUG: "create-olympicjumperl"
-      CF_MODPACK_ZIP: "/modpack.zip"
-      SERVER_NAME: "Create SMP"
-      SEED: "-1307549829135522678"
       MODE: "survival"
       OPS: "Jimcognito,OlympicJumperL"
       ENFORCE_SECURE_PROFILE: "false"
       MEMORY: "4G"
     volumes:
-      - /srv/minecraft-create:/data
+      - /srv/minecraft-survival:/data
-      - /mnt/nas_projects/Create-OlympicJumperL-2026-08-20.zip:/modpack.zip:ro
     stdin_open: true
     tty: true
     restart: unless-stopped