diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 388a5fea..9e436904 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -16,7 +16,18 @@ on:
       - "[0-9]+.[0-9]+.[0-9]+-adopt13"
 
 jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Run tests
+        run: |
+          tests/test.sh
   build:
+    needs:
+      - test
     runs-on: ubuntu-latest
 
     steps:
@@ -32,4 +43,5 @@ jobs:
         tag_with_sha: false
         cache_froms: itzg/minecraft-server:latest
         add_git_labels: true
+        labels: org.opencontainers.image.url=https://github.com/itzg/docker-minecraft-server,org.opencontainers.image.documentation=https://github.com/itzg/docker-minecraft-server
         push: true
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 94d19913..16096da7 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -5,15 +5,12 @@ on:
     branches: [ master ]
 
 jobs:
-  build:
+  test:
     runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@v2
 
-      - name: Build Docker image
-        uses: docker/build-push-action@v1.1.0
-        with:
-          tag_with_sha: true
-          cache_froms: itzg/minecraft-server:latest
-          push: false
+      - name: Run tests
+        run: |
+          tests/test.sh
diff --git a/Dockerfile b/Dockerfile
index 67a88b02..017babd9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,9 @@
 FROM adoptopenjdk/openjdk8-openj9:alpine-nightly
 
-LABEL maintainer "itzg"
+LABEL org.opencontainers.image.authors="Geoff Bourne <itzgeoff@gmail.com>"
+
+# upgrade all packages since alpine jre8 base image tops out at 8u212
+RUN apk -U --no-cache upgrade
 
 RUN apk add --no-cache -U \
   openssl \
diff --git a/README.md b/README.md
index 5a7a9279..c1abb810 100644
--- a/README.md
+++ b/README.md
@@ -324,7 +324,13 @@ There are some limitations to what characters you can use.
 Variables will be replaced in files with the following extensions:
 `.yml`, `.yaml`, `.txt`, `.cfg`, `.conf`, `.properties`.
 
-Specific files can be excluded by listing their name (without path) in the variable `REPLACE_ENV_VARIABLES_EXCLUDES`. Paths can be excluded by listing them in the variable `REPLACE_ENV_VARIABLES_EXCLUDE_PATHS`.
+Specific files can be excluded by listing their name (without path) in the variable `REPLACE_ENV_VARIABLES_EXCLUDES`.
+
+Paths can be excluded by listing them in the variable `REPLACE_ENV_VARIABLES_EXCLUDE_PATHS`. Path
+excludes are recursive. Here is an example:
+```
+REPLACE_ENV_VARIABLES_EXCLUDE_PATHS="/data/plugins/Essentials/userdata/ /data/plugins/MyPlugin/"
+```
 
 Here is a full example where we want to replace values inside a `database.yml`.
 
diff --git a/start-configuration b/start-configuration
index 1218ca7f..deb6e792 100644
--- a/start-configuration
+++ b/start-configuration
@@ -45,6 +45,22 @@ if [[ $PROXY ]]; then
     sleep 5
 fi
 
+if [[ $RCON_PASSWORD_FILE ]]; then
+    log ""
+    if [ ! -e ${RCON_PASSWORD_FILE} ]; then
+	log "Initial RCON password file ${RCON_PASSWORD_FILE} does not seems to exist."
+	log "Please ensure your configuration."
+	log "If you are using Docker Secrets feature, please check this for further information: "
+	log " https://docs.docker.com/engine/swarm/secrets"
+	log ""
+	exit 1
+    else
+	RCON_PASSWORD=$(cat ${RCON_PASSWORD_FILE})
+	export RCON_PASSWORD
+    fi
+    log ""
+fi
+
 export SERVER_PROPERTIES=/data/server.properties
 export VERSIONS_JSON=https://launchermeta.mojang.com/mc/game/version_manifest.json
 
@@ -129,8 +145,9 @@ case "${TYPE^^}" in
 
   *)
       log "Invalid type: '$TYPE'"
-      log "Must be: VANILLA, FORGE, BUKKIT, SPIGOT, PAPER, FTBA, CURSEFORGE, SPONGEVANILLA,"
-      log "         CUSTOM, CURSE_INSTANCE, MAGMA, MOHIST, CATSERVER"
+      log "Must be: VANILLA, FORGE, BUKKIT, SPIGOT, PAPER, FTBA (multiarch-only),"
+      log "         CURSE_INSTANCE, CURSEFORGE, SPONGEVANILLA,"
+      log "         CUSTOM, MAGMA, MOHIST, CATSERVER"
       exit 1
   ;;
 
diff --git a/start-deployBukkitSpigot b/start-deployBukkitSpigot
index 28b07fd3..cb2309e5 100644
--- a/start-deployBukkitSpigot
+++ b/start-deployBukkitSpigot
@@ -62,8 +62,12 @@ function downloadSpigot {
     downloadUrl="https://cdn.getbukkit.org/${getbukkitFlavor}/${getbukkitFlavor}-${VANILLA_VERSION}.jar"
   fi
 
+  if [ -f $SERVER ]; then
+    # tell curl to only download when newer
+    zarg="-z $SERVER"
+  fi
   log "Downloading $match from $downloadUrl ..."
-  curl -fsSL -o $SERVER "$downloadUrl"
+  curl -fsSL -o $SERVER $zarg "$downloadUrl"
   if [[ $? != 0 || $(grep -c "DOCTYPE html" $SERVER) != 0 ]]; then
     cat <<EOF
 
@@ -89,12 +93,12 @@ case "$TYPE" in
     ;;
 esac
 
-if [ ! -f $SERVER ] || [ -n "$FORCE_REDOWNLOAD" ]; then
-   if isTrue "$BUILD_SPIGOT_FROM_SOURCE" || isTrue "$BUILD_FROM_SOURCE"; then
-     buildSpigotFromSource
-   else
-     downloadSpigot
-   fi
+if isTrue "$BUILD_SPIGOT_FROM_SOURCE" || isTrue "$BUILD_FROM_SOURCE"; then
+  if [ ! -f $SERVER ] || [ -n "$FORCE_REDOWNLOAD" ]; then
+    buildSpigotFromSource
+  fi
+else
+  downloadSpigot
 fi
 
 # Normalize on Spigot for operations below
diff --git a/start-deployPaper b/start-deployPaper
index f3d12472..1bc5839e 100644
--- a/start-deployPaper
+++ b/start-deployPaper
@@ -5,17 +5,18 @@
 : ${PAPERBUILD:=latest}
 export SERVER=paper_server-${VANILLA_VERSION}-${PAPERBUILD}.jar
 
-if [ ! -f "$SERVER" ] || [ -n "$FORCE_REDOWNLOAD" ]; then
-    downloadUrl=${PAPER_DOWNLOAD_URL:-https://papermc.io/api/v1/paper/${VANILLA_VERSION}/${PAPERBUILD}/download}
-    log "Downloading Paper $VANILLA_VERSION (build $PAPERBUILD) from $downloadUrl ..."
-    curl -fsSL -o "$SERVER" "$downloadUrl"
-    if [ ! -f "$SERVER" ]; then
-      log "ERROR: failed to download from $downloadUrl (status=$?)"
-      exit 3
-    fi
+if [ -f "$SERVER" ] && ! isTrue "$FORCE_REDOWNLOAD"; then
+  zarg="-z '$SERVER'"
 fi
 
-# Normalize on Spigot for operations below
+downloadUrl=${PAPER_DOWNLOAD_URL:-https://papermc.io/api/v1/paper/${VANILLA_VERSION}/${PAPERBUILD}/download}
+log "Downloading Paper $VANILLA_VERSION (build $PAPERBUILD) from $downloadUrl ..."
+if ! curl -fsSL -o "$SERVER" $zarg "$downloadUrl"; then
+  log "ERROR: failed to download from $downloadUrl (status=$?)"
+  exit 3
+fi
+
+# Normalize on Spigot for downstream operations
 export TYPE=SPIGOT
 export SKIP_LOG4J_CONFIG=true
 
diff --git a/start-finalSetupEnvVariables b/start-finalSetupEnvVariables
index f64f5ec7..4dfc04ca 100644
--- a/start-finalSetupEnvVariables
+++ b/start-finalSetupEnvVariables
@@ -6,15 +6,20 @@
 
 if isTrue "${REPLACE_ENV_VARIABLES}"; then
   log "Replacing env variables in configs that match the prefix $ENV_VARIABLE_PREFIX..."
-
   findExcludes=
+
+  # File excludes
   for f in ${REPLACE_ENV_VARIABLES_EXCLUDES}; do
     findExcludes="${findExcludes} -not -name $f"
   done
-  for p in ${REPLACE_ENV_VARIABLES_EXCLUDE_PATHS}; do
-    findExcludes="${findExcludes} -not -path \"*$p*\""
-  done
-  isDebugging && echo "Using find exclusion: $findExcludes"
+
+  # Directory excludes (recursive)
+  dirExcludes=$(join_by " -o -path " ${REPLACE_ENV_VARIABLES_EXCLUDE_PATHS})
+  if [[ $dirExcludes ]]; then
+    findExcludes+=" -type d ( -path ${dirExcludes} ) -prune"
+  fi
+
+  isDebugging && echo "Using find exclusions: $findExcludes"
 
   while IFS='=' read -r name value ; do
     # check if name of env variable matches the prefix
diff --git a/start-minecraftFinalSetup b/start-minecraftFinalSetup
index e09e53ed..8508f3c9 100644
--- a/start-minecraftFinalSetup
+++ b/start-minecraftFinalSetup
@@ -187,13 +187,10 @@ if [[ ${TYPE} == "CURSE_INSTANCE" ]]; then
 elif [[ ${TYPE} == "FEED-THE-BEAST" ]]; then
     mcServerRunnerArgs="${mcServerRunnerArgs} --shell bash"
 
-    if [ ! -e "${FTB_DIR}/ops.json" -a -e /data/ops.txt ]; then
-      cp -f /data/ops.txt ${FTB_DIR}/
-    fi
-
-    if [ ! -e "${FTB_DIR}/whitelist.json" -a -e /data/white-list.txt ]; then
-      cp -f /data/white-list.txt ${FTB_DIR}/
-    fi
+    # copy player modification files unconditionally since their
+    # processing into json is additive anyway
+    [ -f /data/ops.txt ] && cp -f /data/ops.txt ${FTB_DIR}/
+    [ -f /data/white-list.txt ] && cp -f /data/white-list.txt ${FTB_DIR}/
 
     if [ ! -e "${FTB_DIR}/server-icon.png" -a -e /data/server-icon.png ]; then
       cp -f /data/server-icon.png ${FTB_DIR}/
diff --git a/start-utils b/start-utils
index aa8d933a..0c6fd763 100644
--- a/start-utils
+++ b/start-utils
@@ -1,5 +1,7 @@
 #!/bin/bash
 
+function join_by { local d=$1; shift; echo -n "$1"; shift; printf "%s" "${@/#/$d}"; }
+
 function isURL {
   local value=$1
 
diff --git a/tests/docker-compose.test.yml b/tests/docker-compose.test.yml
new file mode 100644
index 00000000..ed96ba50
--- /dev/null
+++ b/tests/docker-compose.test.yml
@@ -0,0 +1,17 @@
+version: "3.8"
+
+services:
+  sut:
+    depends_on:
+      - mc
+    image: itzg/mc-monitor:0.6.0
+    command: status --host mc --retry-interval 1s --retry-limit 120
+  mc:
+    restart: "no"
+    build:
+      context: ..
+      cache_from:
+      - itzg/minecraft-server:latest
+    environment:
+      EULA: "TRUE"
+
diff --git a/tests/test.sh b/tests/test.sh
new file mode 100755
index 00000000..376aed99
--- /dev/null
+++ b/tests/test.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+cd $(dirname $0)
+
+failed=false
+args="-f docker-compose.test.yml"
+docker-compose $args run sut || failed=true
+echo "
+Result: failed=$failed"
+
+$failed && docker-compose $args logs mc
+docker-compose $args down -v
+
+if $failed; then
+  exit 1
+fi
+