The previous fix (kill anything on port 8420 before up) didn't help -- confirmed nothing was actually squatting on the port. The real cause, per the maintainer: "up -d" run manually a few seconds after "down" always succeeds, but scripted straight through (down && pull && up, pull sometimes a no-op if the image is already cached) fails every time. That's "down" returning before the OS/docker-proxy has actually released port 8420 yet, not an orphaned container -- a timing race, not a stuck process. Retrying "up -d" a few times with a short pause rides out that race without needing to guess a fixed sleep long enough to always cover it.