diff --git a/dockering/ib/docker-compose.yml b/dockering/ib/docker-compose.yml
index de09119b..a5d13cc0 100644
--- a/dockering/ib/docker-compose.yml
+++ b/dockering/ib/docker-compose.yml
@@ -3,11 +3,12 @@
 version: "3.5"
 
 services:
-  ib-gateway:
+  ib_gw_paper:
     # other image tags available:
     # https://github.com/waytrade/ib-gateway-docker#supported-tags
-    image: waytrade/ib-gateway:981.3j
-    restart: always
+    # image: waytrade/ib-gateway:981.3j
+    image: waytrade/ib-gateway:1012.2i
+    restart: always  # restart whenev there's a crash or user clicsk
     network_mode: 'host'
 
     volumes:
@@ -39,14 +40,12 @@ services:
     # this compose file which looks something like:
     # TWS_USERID='myuser'
     # TWS_PASSWORD='guest'
-    # TRADING_MODE=paper (or live)
-    # VNC_SERVER_PASSWORD='diggity'
-
     environment:
       TWS_USERID: ${TWS_USERID}
       TWS_PASSWORD: ${TWS_PASSWORD}
-      TRADING_MODE: ${TRADING_MODE:-paper}
-      VNC_SERVER_PASSWORD: ${VNC_SERVER_PASSWORD:-}
+      TRADING_MODE: 'paper'
+      VNC_SERVER_PASSWORD: 'doggy'
+      VNC_SERVER_PORT: '3003'
 
     # ports:
     #   - target: 4002
@@ -62,3 +61,39 @@ services:
       # - "127.0.0.1:4001:4001"
       # - "127.0.0.1:4002:4002"
       # - "127.0.0.1:5900:5900"
+
+  ib_gw_live:
+    image: waytrade/ib-gateway:1012.2i
+    restart: always
+    network_mode: 'host'
+
+    volumes:
+      - type: bind
+        source: ./jts_live.ini
+        target: /root/jts/jts.ini
+        # don't let ibc clobber this file for
+        # the main reason of not having a stupid
+        # timezone set..
+        read_only: true
+
+      # force our own ibc config
+      - type: bind
+        source: ./ibc.ini
+        target: /root/ibc/config.ini
+
+      # force our noop script - socat isn't needed in host mode.
+      - type: bind
+        source: ./fork_ports_delayed.sh
+        target: /root/scripts/fork_ports_delayed.sh
+
+      # force our noop script - socat isn't needed in host mode.
+      - type: bind
+        # source: ./run_x11_vnc.sh
+        source: ./run_x11_vnc_live.sh
+        target: /root/scripts/run_x11_vnc.sh
+        read_only: true
+
+    # NOTE: to fill these out, define an `.env` file in the same dir as
+    # this compose file which looks something like:
+    environment:
+      TRADING_MODE: 'live'
diff --git a/dockering/ib/ibc.ini b/dockering/ib/ibc.ini
index adbb9843..c9c06658 100644
--- a/dockering/ib/ibc.ini
+++ b/dockering/ib/ibc.ini
@@ -188,7 +188,7 @@ AcceptNonBrokerageAccountWarning=yes
 #
 # The default value is 60.
 
-LoginDialogDisplayTimeout = 60
+LoginDialogDisplayTimeout=20
 
 
 
@@ -292,7 +292,7 @@ ExistingSessionDetectedAction=primary
 # be set dynamically at run-time: most users will never need it,
 # so don't use it unless you know you need it.
 
-OverrideTwsApiPort=4002
+; OverrideTwsApiPort=4002
 
 
 # Read-only Login
diff --git a/dockering/ib/jts_live.ini b/dockering/ib/jts_live.ini
new file mode 100644
index 00000000..291a1e7d
--- /dev/null
+++ b/dockering/ib/jts_live.ini
@@ -0,0 +1,33 @@
+[IBGateway]
+ApiOnly=true
+LocalServerPort=4001
+# NOTE: must be set if using IBC's "reject" mode
+TrustedIPs=127.0.0.1
+; RemoteHostOrderRouting=ndc1.ibllc.com
+; WriteDebug=true
+; RemotePortOrderRouting=4001
+; useRemoteSettings=false
+; tradingMode=p
+; Steps=8
+; colorPalletName=dark
+
+# window geo, this may be useful for sending `xdotool` commands?
+; MainWindow.Width=1986
+; screenHeight=3960
+
+
+[Logon]
+Locale=en
+# most markets are oriented around this zone
+# so might as well hard code it.
+TimeZone=America/New_York
+UseSSL=true
+displayedproxymsg=1
+os_titlebar=true
+s3store=true
+useRemoteSettings=false
+
+[Communication]
+ctciAutoEncrypt=true
+Region=usr
+; Peer=cdc1.ibllc.com:4001
diff --git a/dockering/ib/run_x11_vnc.sh b/dockering/ib/run_x11_vnc.sh
index 1005fb41..d7e2a658 100755
--- a/dockering/ib/run_x11_vnc.sh
+++ b/dockering/ib/run_x11_vnc.sh
@@ -1,20 +1,35 @@
 #!/bin/sh
+# start vnc server and listen for connections
+# on port specced in `$VNC_SERVER_PORT`
 
-# start VNC server
 x11vnc \
     -listen 127.0.0.1 \
     -allow 127.0.0.1 \
-    -autoport 3003 \
-    -no6 \
-    -noipv6 \
+    -rfbport "${VNC_SERVER_PORT}" \
     -display :1 \
-    -bg \
     -forever \
     -shared \
-    -logappend /var/log/x11vnc.log \
-    -ncache_cr \
-    -ncache \
+    -bg \
+    -nowf \
+    -noxdamage \
+    -noxfixes \
 
-    # can't use this because of ``asyncvnc`` issue:
+
+    # -nowcr \
+    # TODO: can't use this because of ``asyncvnc`` issue:
     # https://github.com/barneygale/asyncvnc/issues/1
     # -passwd 'ibcansmbz'
+
+    # XXX: optional graphics caching flags that seem to rekt the overlay
+    # of the 2 gw windows? When running a single gateway
+    # this seems to maybe optimize some memory usage?
+    # -ncache_cr \
+    # -ncache \
+    # -no6 \
+    # -noipv6 \
+
+    # NOTE: this will prevent logs from going to the console.
+    # -logappend /var/log/x11vnc.log \
+
+    # where to start allocating ports
+    # -autoport "${VNC_SERVER_PORT}" \
diff --git a/dockering/ib/run_x11_vnc_live.sh b/dockering/ib/run_x11_vnc_live.sh
new file mode 100755
index 00000000..1a248525
--- /dev/null
+++ b/dockering/ib/run_x11_vnc_live.sh
@@ -0,0 +1 @@
+#!/bin/sh