Update dependency itzg/mc-image-helper to v1.64.1 (#4213 )

Enhance SECURITY.md with automated scan information (#4212 )
Enable compact object headers on Java 24+ (#4211 )
2026-08-17 12:43:17 +00:00 · 2026-08-03 21:50:05 -05:00 · 2026-08-03 14:30:13 -05:00 · 2026-08-03 07:10:14 -05:00 · 2026-08-02 16:12:38 -05:00 · 2026-08-02 06:54:08 -05:00
60 changed files with 472 additions and 272 deletions
@@ -6,11 +6,15 @@ on:
 jobs:
  auto-release:
    runs-on: ubuntu-latest
-    permissions:
-      # allow for creating releases/tags
-      contents: write
+    # If forked, changed to your username to enable auto-releases
+    if: github.repository_owner == 'itzg'
    steps:
      - uses: zenengeo/github-auto-release-action@main
        with:
          stable-duration: 3d
-          force-duration: 14d  
+          force-duration: 14d
+          # It is important to use a token other than the workflow allocated GITHUB_TOKEN,
+          # since actions prevent loops by disallowing recursive workflow triggers with that token.
+          # In this case, the created tag needs to trigger the "Build and Publish" workflow.
+          token: '${{ secrets.GH_TOKEN }}'
+
@@ -18,6 +18,7 @@ on:
      - "zensical.toml"
      - ".readthedocs.yaml"
      - "renovate.json5"
+  workflow_dispatch:

 jobs:
  build:
@@ -29,10 +30,13 @@ jobs:
          - java25
          - java25-alpine
          - java25-jdk
+          - java25-graalvm
          - java21
          - java21-alpine
+          - java21-graalvm
          - java21-jdk
          - java17
+          - java17-graalvm
          - java16
          - java11
          - java8
@@ -49,12 +53,14 @@ jobs:
            baseImage: eclipse-temurin:25-jre-alpine
            platforms: linux/amd64,linux/arm64
            mcVersion: latest
-            # For GLIBC_2.34 support (and Alpine)
-            knockdRepoOrg: Metalcape/knock
          - variant: java25-jdk
            baseImage: eclipse-temurin:25
            platforms: linux/amd64,linux/arm64
            mcVersion: latest
+          - variant: java25-graalvm
+            baseImage: container-registry.oracle.com/graalvm/jdk:25-ol10
+            platforms: linux/amd64,linux/arm64
+            mcVersion: latest
        # JAVA 21:
          - variant: java21
            baseImage: eclipse-temurin:21-jre
@@ -68,55 +74,57 @@ jobs:
            baseImage: eclipse-temurin:21-jre-alpine
            platforms: linux/amd64,linux/arm64
            mcVersion: 1.21.11
-            # For GLIBC_2.34 support (and Alpine)
-            knockdRepoOrg: Metalcape/knock
+          - variant: java21-graalvm
+            baseImage: container-registry.oracle.com/graalvm/jdk:21-ol10
+            platforms: linux/amd64,linux/arm64
+            mcVersion: 1.21.11
        # JAVA 17:
          - variant: java17
            # jammy doesn't work until minecraft updates to https://github.com/netty/netty/issues/12343
            baseImage: eclipse-temurin:17-jre-focal
            platforms: linux/amd64,linux/arm/v7,linux/arm64
            mcVersion: 1.20.4
-            # For GLIBC_2.34 support (and Alpine)
-            knockdRepoOrg: Metalcape/knock
+          - variant: java17-graalvm
+            baseImage: container-registry.oracle.com/graalvm/jdk:17-ol10
+            platforms: linux/amd64,linux/arm64
+            mcVersion: 1.20.4
        # JAVA 16
          - variant: java16
            baseImage: adoptopenjdk:16-jre-hotspot
            platforms: linux/amd64,linux/arm/v7,linux/arm64
            mcVersion: 1.16.5
-            # For GLIBC_2.34 support
-            knockdRepoOrg: Metalcape/knock
            # Pin version for pre-Java 17
-            mcHelperVersion: 1.51.3-java8
+            mcHelperVersion: 1.51.4-java8
        # JAVA 11
          - variant: java11
            baseImage: adoptopenjdk:11-jre-hotspot
            platforms: linux/amd64,linux/arm/v7,linux/arm64
            mcVersion: 1.16.4
-            # For GLIBC_2.34 support
-            knockdRepoOrg: Metalcape/knock
            # Pin version for pre-Java 17
-            mcHelperVersion: 1.51.3-java8
+            mcHelperVersion: 1.51.4-java8
        # JAVA 8: NOTE: Unable to go past 8u312 because of Forge dependencies
          - variant: java8
            baseImage: eclipse-temurin:8u312-b07-jre-focal
            platforms: linux/amd64,linux/arm/v7,linux/arm64
            mcVersion: 1.12.2
-            # For GLIBC_2.34 support
-            knockdRepoOrg: Metalcape/knock
            # Pin version for Java 8, also be sure to set in verify-pr.yml
-            mcHelperVersion: 1.51.3-java8
+            mcHelperVersion: 1.51.4-java8
          - variant: java8-jdk
            baseImage: eclipse-temurin:8u312-b07-jdk-focal
            platforms: linux/amd64,linux/arm64
            mcVersion: 1.12.2
-            # For GLIBC_2.34 support
-            knockdRepoOrg: Metalcape/knock
            # Pin version for Java 8, also be sure to set in verify-pr.yml
-            mcHelperVersion: 1.51.3-java8
+            mcHelperVersion: 1.51.4-java8
    env:
+      # Assume they line up, but when forked change to your Docker Hub username
+      DOCKER_HUB_ORG: ${{ github.repository_owner }}
      IMAGE_TO_TEST: "${{ github.repository_owner }}/minecraft-server:test-${{ matrix.variant }}-${{ github.run_id }}"
+      # NOTE: env values are always strings, so the boolean-valued ones below have to be
+      # compared with == 'true'. Used bare, the string "false" evaluates as true.
      HAS_IMAGE_REPO_ACCESS: ${{ secrets.DOCKER_USER != '' && secrets.DOCKER_PASSWORD != '' }}
      MAIN_VARIANT: java25
+      PUSH: ${{ github.repository_owner == 'itzg' }}
+      IMAGE_AUTHOR: "Geoff Bourne <itzgeoff@gmail.com>"
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
@@ -129,10 +137,8 @@ jobs:
        id: meta
        uses: docker/metadata-action@v6.2.0
        with:
-          # NOTE for forks: if your Docker Hub organization doesn't match your Github repo's,
-          # then the use of ${{ github.repository_owner }} will need to be replaced.
          images: |
-            ${{ github.repository_owner }}/minecraft-server
+            ${{ env.DOCKER_HUB_ORG }}/minecraft-server
            ghcr.io/${{ github.repository_owner }}/minecraft-server
          tags: |
            # Apply the variant as a moving tag for most recent commit per variant
@@ -154,7 +160,7 @@ jobs:
          flavor: |
            latest=${{ matrix.variant == env.MAIN_VARIANT && github.ref_name == github.event.repository.default_branch }}
          labels: |
-            org.opencontainers.image.authors=Geoff Bourne <itzgeoff@gmail.com>
+            org.opencontainers.image.authors=${{ env.IMAGE_AUTHOR }}

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v4
@@ -189,15 +195,15 @@ jobs:
          tests/test.sh

      - name: Login to DockerHub
-        uses: docker/login-action@v4.4.0
-        if: env.HAS_IMAGE_REPO_ACCESS
+        uses: docker/login-action@v4.5.2
+        if: env.HAS_IMAGE_REPO_ACCESS == 'true'
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Login to GHCR
-        uses: docker/login-action@v4.4.0
-        if: env.HAS_IMAGE_REPO_ACCESS
+        uses: docker/login-action@v4.5.2
+        if: env.HAS_IMAGE_REPO_ACCESS == 'true'
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -210,13 +216,16 @@ jobs:
          platforms: ${{ matrix.platforms }}
          push: >
            ${{ 
-            github.ref_type == 'tag' 
-            || github.ref_name == github.event.repository.default_branch
-            || startsWith(github.ref_name, 'test/')
-            || ( github.event_name == 'pull_request' 
-                 && env.HAS_IMAGE_REPO_ACCESS 
-                 && contains(github.event.pull_request.labels.*.name, 'ci/push-image') 
-               )
+            env.PUSH == 'true' &&
+            (
+              github.ref_type == 'tag' 
+              || github.ref_name == github.event.repository.default_branch
+              || startsWith(github.ref_name, 'test/')
+              || ( github.event_name == 'pull_request' 
+                   && env.HAS_IMAGE_REPO_ACCESS == 'true'
+                   && contains(github.event.pull_request.labels.*.name, 'ci/push-image') 
+                 )
+            )
            }}
          tags: ${{ steps.meta.outputs.tags }}
          # ensure latest base image is used
@@ -233,5 +242,6 @@ jobs:
            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
            ${{ matrix.mcHelperVersion && format('MC_HELPER_VERSION={0}', matrix.mcHelperVersion) }}
            ${{ matrix.knockdRepoOrg && format('KNOCKD_REPO_ORG={0}', matrix.knockdRepoOrg) }}
+            IMAGE_AUTHOR=${{ env.IMAGE_AUTHOR }}
          cache-from: type=gha,scope=${{ matrix.variant }}
          cache-to: type=gha,mode=max,scope=${{ matrix.variant }}
@@ -16,6 +16,7 @@ jobs:
  discord:
    runs-on: ubuntu-latest
    timeout-minutes: 5
+    if: github.repository_owner == 'itzg'
    steps:
      - name: on-publish
        if: github.event_name == 'release' && github.event.action == 'published'
@@ -7,9 +7,13 @@ on:
      - labeled
      - unlabeled
      - closed
-
+  pull_request_target:
+    types:
+      - closed
+      - labeled
 jobs:
  notify:
+    if: github.repository_owner == 'itzg'
    uses: itzg/github-workflows/.github/workflows/issues-notify-discord.yml@main
    with:
      triageLabel: 'status/needs triage'
@@ -7,12 +7,13 @@ on:
 jobs:
  check:
    runs-on: ubuntu-22.04
+    if: github.repository_owner == 'itzg'
    permissions:
      issues: write
      pull-requests: write
    steps:
      - name: Process Stale Issues
-        uses: actions/stale@v10
+        uses: actions/stale@v11
        with:
          stale-issue-label: status/stale
          stale-pr-label: status/stale
@@ -24,6 +24,7 @@ jobs:
        variant:
          - java25
          - java25-alpine
+          - java25-graalvm
          - java17
          - java8
        include:
@@ -39,6 +40,11 @@ jobs:
            mcVersion: latest
            # For GLIBC_2.34 support (and Alpine)
            knockdRepoOrg: Metalcape/knock
+          - variant: java25-graalvm
+            # stay aligned with build.yml
+            baseImage: container-registry.oracle.com/graalvm/jdk:25-ol10
+            platforms: linux/amd64,linux/arm64
+            mcVersion: latest
        # JAVA 17:
          - variant: java17
            # jammy doesn't work until minecraft updates to https://github.com/netty/netty/issues/12343
@@ -47,6 +53,7 @@ jobs:
            mcVersion: 1.20.4
            # For GLIBC_2.34 support
            knockdRepoOrg: Metalcape/knock
+        # JAVA 8:
          - variant: java8
            baseImage: eclipse-temurin:8u312-b07-jre-focal
            platforms: linux/amd64
@@ -54,7 +61,7 @@ jobs:
            # For GLIBC_2.34 support
            knockdRepoOrg: Metalcape/knock
            # Pin version for Java 8, be sure to also set in build.yml
-            mcHelperVersion: 1.51.3-java8
+            mcHelperVersion: 1.51.4-java8
    env:
      IMAGE_TO_TEST: ${{ github.repository_owner }}/minecraft-server:test-${{ matrix.variant }}-${{ github.run_id }}
    runs-on: ubuntu-22.04
@@ -68,6 +75,9 @@ jobs:
      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v4

+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4.2.0
+
      - name: Confirm multi-arch build
        uses: docker/build-push-action@v7
        with:
@@ -13,7 +13,7 @@ ARG EXTRA_DNF_PACKAGES=""
 ARG EXTRA_ALPINE_PACKAGES=""
 ARG FORCE_INSTALL_PACKAGES=1
 ARG KNOCKD_VERSION=0.8.1
-ARG KNOCKD_REPO_ORG=Opvolger/knock
+ARG KNOCKD_REPO_ORG=Metalcape/knock
 RUN --mount=target=/build,source=build \
    TARGET=${TARGETARCH}${TARGETVARIANT} \
    /build/run.sh install-packages
@@ -45,7 +45,7 @@ RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
  --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz

 # renovate: datasource=github-releases packageName=itzg/mc-monitor
-ARG MC_MONITOR_VERSION=0.16.11
+ARG MC_MONITOR_VERSION=0.17.0
 RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
  --var version=${MC_MONITOR_VERSION} --var app=mc-monitor --file {{.app}} \
  --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
@@ -57,7 +57,7 @@ RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
  --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz

 # renovate: datasource=github-releases packageName=itzg/mc-image-helper versioning=loose
-ARG MC_HELPER_VERSION=1.61.4
+ARG MC_HELPER_VERSION=1.64.1
 ARG MC_HELPER_BASE_URL=${GITHUB_BASEURL}/itzg/mc-image-helper/releases/download/${MC_HELPER_VERSION}
 # used for cache busting local copy of mc-image-helper
 ARG MC_HELPER_REV=1
@@ -6,9 +6,10 @@
 [![](https://img.shields.io/badge/Donate-Buy%20me%20a%20coffee-orange.svg)](https://www.buymeacoffee.com/itzg)
 [![Documentation Status](https://readthedocs.org/projects/docker-minecraft-server/badge/?version=latest)](https://docker-minecraft-server.readthedocs.io/en/latest/?badge=latest)

- [![Read the docs](docs/img/banner-docs.png)](https://docker-minecraft-server.readthedocs.io/)
+[![Read the docs](docs/img/banner-docs.png)](https://docker-minecraft-server.readthedocs.io/)

 There you will find things like
+
 - [Quick start with Docker Compose](https://docker-minecraft-server.readthedocs.io/en/latest/#using-docker-compose)
 - Running [different versions of Minecraft](https://docker-minecraft-server.readthedocs.io/en/latest/versions/minecraft/) and using [various server types](https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/) for Java Edition
 - [Setting server properties via container environment variables](https://docker-minecraft-server.readthedocs.io/en/latest/configuration/server-properties/)
@@ -36,6 +37,12 @@ This image only supports Java edition natively; however, if looking for a server

 <br clear="left" />

+<a href="https://seedloaf.com"><img src="https://seedloaf.com/images/logo.webp" alt="Seedloaf logo" width="48" align="left" /></a>
+
+<a href="https://seedloaf.com"><b>Seedloaf</b></a> - Built from scratch (by two nerds) on top of <code>itzg/minecraft-server</code>. Seedloaf offers free, and premium Minecraft servers where you have full control!
+
+<br clear="left" />
+
 <!-- additional sponsors repeat the pattern above: floated logo + blurb + clear-left break -->
 <!-- logo image preferrably hosted on an external, stable site at a size of 48x48px -->
 <!-- link to sponsor site -->
@@ -0,0 +1,39 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release or `latest` Docker tag receives security updates. If you discover a vulnerability, please test against the latest image version before reporting.
+
+## Automated Scans & Base Image Dependency Updates
+
+- **Automated Dependency Updates:** This repository utilizes automated background workflows to continuously upgrade base images, underlying dependencies, and the Go toolchain. Because CVE scanning tools flag vulnerabilities as soon as they are logged it is not practical to address them any faster than the automation is doing.
+- **Image Scan Reports & Triaging:** Please refrain from submitting raw scanner reports or screenshots (e.g., outputs from Trivy, Grype, or Docker Scout). CVEs in upstream base packages or system libraries are often constrained by upstream package maintainers. Submitting an issue or advisory for a scanner report does not accelerate a fix if the patch is not yet available in the upstream base image.
+- **Actionable PRs Welcome:** If a fix or patched package version **is** available upstream and has not yet been picked up by our automated build pipelines, submitting a pull request that updates the specific version pin or dependency is the best way to help speed up integration.
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
+
+To report a vulnerability privately:
+
+1. Navigate to the **[Security](https://github.com/itzg/docker-minecraft-server/security)** tab of this repository.
+2. Select **Report a vulnerability** to open a private security advisory.
+
+This allows us to review, reproduce, and resolve the issue in a private environment before public disclosure.
+
+---
+
+## Important Expectations & Bug Bounties
+
+* **No Financial Bounties:** This is an open-source, community-maintained project. We **do not** offer financial rewards, gift cards, or monetary bounties for vulnerability reports.
+* **Non-Critical & Automated Findings:** Reports generated purely by automated scanners (such as generic HTTP headers, low-severity container base image updates, or standard configuration warnings) without a working, practical proof-of-concept specific to this container will generally be closed.
+
+---
+
+## Dependency Upgrades & Pull Requests
+
+We welcome and appreciate community contributions! 
+
+If you identify an outdated or vulnerable upstream dependency (such as base packages, utilities, or underlying binaries), **we strongly encourage you to submit a Pull Request directly**. 
+
+Community-contributed PRs targeting dependency patches are the fastest way to get updates validated, built, and merged into the main release.
@@ -3,6 +3,13 @@
 set -e
 set -o pipefail

+# Patched knockd is only available for amd64 on Alpine, so install the package for other architectures
+knockPkg=""
+if [ "$TARGETARCH" != amd64 ]; then
+  knockPkg="knock"
+  echo "Installing knock package for $TARGETARCH architecture"
+fi
+
 # Install necessary packages
 # shellcheck disable=SC2086
 apk add --no-cache -U \
@@ -35,13 +42,19 @@ apk add --no-cache -U \
    libcap \
    numactl \
    jattach \
+    gcompat \
+    "$knockPkg" \
    ${EXTRA_ALPINE_PACKAGES}

-# Download and install patched knockd
-curl -fsSL -o /tmp/knock.tar.gz "https://github.com/${KNOCKD_REPO_ORG}/releases/download/${KNOCKD_VERSION}/knock-${KNOCKD_VERSION}-alpine-amd64.tar.gz"
-tar -xf /tmp/knock.tar.gz -C /usr/local/ && rm /tmp/knock.tar.gz
-ln -s /usr/local/sbin/knockd /usr/sbin/knockd
-setcap cap_net_raw=ep /usr/local/sbin/knockd
+if ! [ "$knockPkg" ]; then
+  # Download and install patched knockd
+  knockdUrl="https://github.com/${KNOCKD_REPO_ORG}/releases/download/${KNOCKD_VERSION}/knock-${KNOCKD_VERSION}-alpine-amd64.tar.gz"
+  echo "Downloading knockd from $knockdUrl"
+  curl -fsSL -o /tmp/knock.tar.gz "$knockdUrl"
+  tar -xf /tmp/knock.tar.gz -C /usr/local/ && rm /tmp/knock.tar.gz
+  ln -s /usr/local/sbin/knockd /usr/sbin/knockd
+  setcap cap_net_raw=ep /usr/local/sbin/knockd
+fi

 # Set Git credentials globally
 cat <<EOF >> /etc/gitconfig
@@ -66,16 +66,12 @@ fi
 # Clean up DNF when done
 dnf clean all

-cat <<EOF > /usr/local/sbin/knockd
-#!/bin/sh
-
-echo "Auto-pause (using knockd) is currently unavailable on graalvm image variants"
-echo "Consider using a different image variant https://docker-minecraft-server.readthedocs.io/en/latest/versions/java/"
-echo "or mc-router's auto scale up/down feature https://github.com/itzg/mc-router#docker-auto-scale-updown"
-exit 2
-EOF
-chmod 755 /usr/local/sbin/knockd
-# TODO restore retrieval from https://github.com/Metalcape/knock when tar's "Cannot open: Invalid argument" is solved
+# Download and install patched knockd
+curl -fsSL -o /tmp/knock.tar.gz https://github.com/Metalcape/knock/releases/download/0.8.1/knock-0.8.1-$TARGET.tar.gz
+tar -xf /tmp/knock.tar.gz -C /usr/local/ && rm /tmp/knock.tar.gz
+ln -s /usr/local/sbin/knockd /usr/sbin/knockd
+ls -l /usr/local/sbin/knockd
+setcap cap_net_raw=ep /usr/local/sbin/knockd

 # Set git credentials globally
 cat <<EOF >> /etc/gitconfig
@@ -1,2 +1,6 @@
+#!/bin/sh
+
+set -e
+
 groupadd --gid 1000 minecraft
 useradd --system --shell /bin/false --uid 1000 -g minecraft --home /data minecraft
@@ -37,8 +37,13 @@ apt-get install -y \
 # Clean up APT when done
 apt-get clean

+if [ "$TARGETARCH" = riscv64 ]; then
+  KNOCKD_REPO_ORG=Opvolger/knock
+fi
 # Download and install patched knockd
-curl -fsSL -o /tmp/knock.tar.gz "https://github.com/${KNOCKD_REPO_ORG}/releases/download/${KNOCKD_VERSION}/knock-${KNOCKD_VERSION}-$TARGET.tar.gz"
+knockdUrl="https://github.com/${KNOCKD_REPO_ORG}/releases/download/${KNOCKD_VERSION}/knock-${KNOCKD_VERSION}-$TARGET.tar.gz"
+echo "Downloading knockd from $knockdUrl"
+curl -fsSL -o /tmp/knock.tar.gz "$knockdUrl"
 tar -xf /tmp/knock.tar.gz -C /usr/local/ && rm /tmp/knock.tar.gz
 ln -s /usr/local/sbin/knockd /usr/sbin/knockd
 setcap cap_net_raw=ep /usr/local/sbin/knockd
@@ -179,6 +179,10 @@ such as:

 You may configure the use of an HTTP/HTTPS proxy by passing the proxy's "host:port" via the environment variable `PROXY`. In [the example compose file](https://github.com/itzg/docker-minecraft-server/blob/master/examples/proxied/compose.yml) it references a Squid proxy. The host and port can be separately passed via the environment variables `PROXY_HOST` and `PROXY_PORT`. A `|` delimited list of hosts to exclude from proxying can be passed via `PROXY_NON_PROXY_HOSTS`.

+## Prefer IPv6 Addresses and Stack
+
+The image can be configured to prefer IPv6 addresses and stack by setting the environment variable `PREFER_IPV6` to "true". This will ensure the Java properties `java.net.preferIPv6Addresses` and `java.net.preferIPv6Stack` are set accordingly for mc-image-helper and the Minecraft server process.
+
 ## Using "noconsole" option

 Some older versions (pre-1.14) of Spigot required `--noconsole` to be passed when detaching stdin, which can be done by setting `-e CONSOLE=FALSE`.
@@ -198,6 +202,13 @@ Be sure to also increase the shutdown timeout described [here for docker compose

 If you are using a host-attached data directory, then you can have the image setup the Minecraft server files and stop prior to launching the server process by setting `SETUP_ONLY` to `true`. 
    
+## Custom server runner
+
+By default, the image finishes startup by exec'ing [mc-server-runner](https://github.com/itzg/mc-server-runner) to run the Minecraft server itself. This can be replaced by setting the environment variable `SERVER_RUNNER`. The arguments passed will start with ones specific to mc-server-runner, followed by `--`, and then the actual `java -jar` arguments or equivalent server entry script, such as `run.sh` for Forge. 
+
+> [!TIP]
+> The `SERVER_RUNNER` variable is expanded when passed to `exec` so that `mc-server-runner` can be wrapped by another executable that is mounted into the container.
+
 ## Enable Flare Flags
    
 To enable the JVM flags required to fully support the [Flare profiling suite](https://blog.airplane.gg/flare), set the following variable:
@@ -4,9 +4,9 @@ Mods and plugins can be auto-downloaded and upgraded from CurseForge by setting

 A specific file can be omitted from each reference to allow for auto-selecting the newest version of the selected mod/plugin. The resolved `VERSION` and `TYPE` will be taken into consideration for selecting the appropriate file. 

-!!! warning "CurseForge API key usage"
+!!! info "CurseForge API key usage"

-    A CurseForge API key must be allocated and set with `CF_API_KEY` (or `CF_API_KEY_FILE`) [as described here](../types-and-platforms/mod-platforms/auto-curseforge.md#api-key).
+    A CurseForge API key is _now_ included by this image; however, you can always supply your own instead. A CurseForge API key can be allocated and set with `CF_API_KEY` (or `CF_API_KEY_FILE`) [as described here](../types-and-platforms/mod-platforms/auto-curseforge.md#api-key).

 ## Project-file references

@@ -151,6 +151,26 @@ GENERIC_PACKS_SUFFIX=.zip

 would expand to `https://cdn.example.org/configs-v9.0.1.zip,https://cdn.example.org/mods-v4.3.6.zip`.

+### Generic packs from an OCI registry
+
+An entry can also reference a pack stored as an [OCI](https://opencontainers.org/) artifact in a container registry by prefixing it with `oci://`. The reference may use a tag or an immutable `@sha256:` digest:
+
+```
+GENERIC_PACKS=oci://ghcr.io/itzg/oci-modpack-template/tech:latest,oci://ghcr.io/itzg/oci-modpack-template/magic:latest
+```
+
+OCI, URL, and local-path entries can be mixed in the same list and are applied in the order given. Each artifact's layers are pulled into a content-addressed cache under `/data/packs/oci`, so a digest already on disk (for example a base layer shared between packs) is not downloaded again. `GENERIC_PACKS_PREFIX`/`GENERIC_PACKS_SUFFIX`, `GENERIC_PACKS_DISABLE_MODS`, and the update/checksum behaviour below all apply to OCI entries exactly as they do to URLs.
+
+The artifact must be a Minecraft modpack artifact (artifact type `application/vnd.itzg.minecraft.modpack.v1+json` with `…modpack.layer.v1.tar+gzip` layers); any other reference is rejected before its contents touch `/data`. Validation and registry authentication are handled by `mc-image-helper`.
+
+For a private registry, point `GENERIC_PACKS_OCI_AUTH_FILE` at a registry login file (the `auth.json`/`config.json` produced by `docker login`, `podman login`, etc.):
+
+```
+GENERIC_PACKS_OCI_AUTH_FILE=/run/secrets/registry-auth.json
+```
+
+When it is unset, a credentials file at `~/.config/containers/auth.json` or `~/.docker/config.json` is used if present, otherwise the pull is anonymous.
+
 If applying large generic packs, the update can be time-consuming. To skip the update set `SKIP_GENERIC_PACK_UPDATE_CHECK` to "true". Conversely, the generic pack(s) can be forced to be applied by setting `FORCE_GENERIC_PACK_UPDATE` to "true".

 The most time-consuming portion of the generic pack update is generating and comparing the SHA1 checksum. To skip the checksum generation, set `SKIP_GENERIC_PACK_CHECKSUM` to "true".
@@ -14,7 +14,7 @@ mkdocstrings==1.0.6
 mkdocstrings-python==2.0.5
 packaging==26.2
 pathspec==1.1.1
-platformdirs==4.10.0
+platformdirs==4.11.0
 Pygments==2.20.0
 pymdown-extensions==11.0.1
 python-dateutil==2.9.0.post0
@@ -22,4 +22,4 @@ PyYAML==6.0.3
 pyyaml_env_tag==1.1
 six==1.17.0
 watchdog==6.0.0
-zensical==0.0.50
+zensical==0.0.51
@@ -4,9 +4,9 @@ To manage a CurseForge modpack automatically with upgrade support, pinned or lat

 ## API Key

-!!! warning "CurseForge API key usage"
+!!! info "CurseForge API key usage"

-    A CurseForge API key is **required** to use this feature. Go to their [developer console](https://console.curseforge.com/), generate an API key, and set the environment variable `CF_API_KEY`.
+    A CurseForge API key is _now_ included by this image; however, you can always supply your own instead. Go to their [developer console](https://console.curseforge.com/), generate an API key, and set the environment variable `CF_API_KEY`.

    When entering your API Key in a docker compose file you will need to escape any `$` character with a second `$`. Refer to [this compose file reference section](https://docs.docker.com/compose/compose-file/compose-file-v3/#variable-substitution) for more information.

@@ -79,13 +79,11 @@ Pass a page URL to the modpack or a specific file with `CF_PAGE_URL` such as the
    environment:
      # ...
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # allocate from https://console.curseforge.com/ and set in .env file
-      CF_API_KEY: ${CF_API_KEY}
      CF_PAGE_URL: https://www.curseforge.com/minecraft/modpacks/all-the-mods-8
    ```

    ```title="Using docker run"
-    docker run -e CF_API_KEY=${CF_API_KEY} -e TYPE=AUTO_CURSEFORGE -e CF_PAGE_URL=https://www.curseforge.com/minecraft/modpacks/all-the-mods-8
+    docker run -e TYPE=AUTO_CURSEFORGE -e CF_PAGE_URL=https://www.curseforge.com/minecraft/modpacks/all-the-mods-8
    ```

 Instead of a URL, the modpack slug can be provided as `CF_SLUG`. The slug is the short identifier visible in the URL after "/modpacks/", such as
@@ -98,13 +96,11 @@ Instead of a URL, the modpack slug can be provided as `CF_SLUG`. The slug is the
    environment:
      # ...
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # allocate from https://console.curseforge.com/ and set in .env file
-      CF_API_KEY: ${CF_API_KEY}
      CF_SLUG: all-the-mods-8
    ```

    ```title="Using docker run"
-    docker run -e CF_API_KEY=${CF_API_KEY} -e TYPE=AUTO_CURSEFORGE -e CF_SLUG=all-the-mods-8
+    docker run -e TYPE=AUTO_CURSEFORGE -e CF_SLUG=all-the-mods-8
    ```

 ### Pinning modpack and mod loader versions
@@ -148,7 +144,6 @@ By default, AUTO_CURSEFORGE will use the exact modloader version declared by the
    ```yaml
    environment:
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      CF_API_KEY: ${CF_API_KEY}
      CF_SLUG: all-the-mods-8
      CF_MOD_LOADER_VERSION: "43.4.22"
    ```
@@ -197,8 +192,6 @@ If you wish to use an unpublished modpack zip, set the container path to the fil
        environment:
          EULA: true
          MODPACK_PLATFORM: AUTO_CURSEFORGE
-          # allocate from https://console.curseforge.com/ and set in .env file
-          CF_API_KEY: ${CF_API_KEY}
          CF_MODPACK_MANIFEST: /manifests/manifest.json
          CF_SLUG: "custom"
        volumes:
@@ -12,7 +12,7 @@ Configuration options with defaults:

 ## Set Modpack version

-As GTNH is a Minecraft 1.7.10 modpack, when using it your minecraft version is set to 1.7.10 by default. The [modpack version](https://www.gtnewhorizons.com/downloads/) can be selected by setting `GTNH_PACK_VERSION` to `latest`, `latest-dev` or any specific version number. `latest` will automatically select the latest full release version available and deploy the server with it (Note: this will also automatically update the server on startup). `latest-dev` does the same but selects the latest version marked as beta or RC (it won't select a full release version even if a newer exist). The third (and recommended) option is setting the server to a specific version like `2.8.1` to manage updates manually.
+As GTNH is a Minecraft 1.7.10 modpack, when using it your minecraft version is set to 1.7.10 by default. The [modpack version](https://www.gtnewhorizons.com/downloads/) can be selected by setting `GTNH_PACK_VERSION` to `latest`, `latest-beta` (formerly `latest-dev`) or any specific version number. `latest` will automatically select the latest full release version available and deploy the server with it (Note: this will also automatically update the server on startup). `latest-beta` does the same but selects the latest version marked as beta or RC (it won't select a full release version even if a newer exist). The third (and recommended) option is setting the server to a specific version like `2.8.1` to manage updates manually.

 > To actively prevent an update from happening you can set the environment variable `SKIP_GTNH_UPDATE_CHECK` to true this will prevent any update check from running, but will also prevent the server install from running, so just set it after the initial setup.

@@ -52,3 +52,11 @@ To deliver the intended GTNH by default, when running a GTNH server, the followi
 With java 17+ the server starts with `-Dfml.readTimeout=180 @java9args.txt -jar lwjgl3ify-forgePatches.jar`. 

 With java 8 the server stars with `-XX:+UseStringDeduplication -XX:+UseCompressedOops -XX:+UseCodeCacheFlushing -Dfml.readTimeout=180 -jar forge-1.7.10-10.13.4.1614-1.7.10-universal.jar`
+
+## Developer Versions
+
+To run the nightly developer builds of GTNH, set the environment variable `GTNH_USE_DAILY_BUILD` to true and set `GTNH_PACK_VERSION` either to `latest` or a specific run ID of the build workflow. The run ID can be found in the [GTNH GitHub Actions](https://github.com/GTNewHorizons/DreamAssemblerXXL/actions) page of the DreamAssemblerXXL repository. The run ID is the number in the URL of the workflow run, for example `123456789`. 
+
+Since downloads require authentication, you will also need to set the environment variable `GH_TOKEN` to a valid GitHub Personal Access Token with `public_repo` scope. You can create a token in your [GitHub settings](https://github.com/settings/tokens) page. Be sure to keep your token secret and do not share it with anyone. The token is only used to download the developer builds and is not stored anywhere in the server (except in the environment variables). 
+
+Keep in mind that developer builds are not stable and may contain bugs or incomplete features. Use them at your own risk. It is recommended to use the latest stable release for production servers!
@@ -17,10 +17,13 @@ where `<tag>` refers to the first column of this table:
 | java25        | 25           | Ubuntu | Hotspot     | amd64, arm64, riscv64 |      |
 | java25-alpine | 25           | Alpine | Hotspot     | amd64, arm64          |      |
 | java25-jdk    | 25           | Ubuntu | Hotspot+JDK | amd64, arm64          |      |
+| java25-graalvm | 25          | Oracle | Oracle GraalVM | amd64, arm64       | (2)(3) |
 | java21        | 21           | Ubuntu | Hotspot     | amd64, arm64          |      |
 | java21-jdk    | 21           | Ubuntu | Hotspot+JDK | amd64, arm64          |      |
 | java21-alpine | 21           | Alpine | Hotspot     | amd64, arm64          |      |
+| java21-graalvm | 21          | Oracle | Oracle GraalVM | amd64, arm64       | (2)(3) |
 | java17        | 17           | Ubuntu | Hotspot     | amd64, arm64, armv7   |      |
+| java17-graalvm | 17          | Oracle | Oracle GraalVM | amd64, arm64       | (2)(3) |
 | java16        | 16           | Ubuntu | Hotspot     | amd64, arm64, armv7   | (1)  |
 | java11        | 11           | Ubuntu | Hotspot     | amd64, arm64, armv7   |      |
 | java8         | 8            | Ubuntu | Hotspot     | amd64, arm64, armv7   |      |
@@ -28,6 +31,8 @@ where `<tag>` refers to the first column of this table:
 Notes

 1. This version of Java is [recommended for PaperMC 1.16.5](https://docs.papermc.io/paper/getting-started/#requirements)
+2. Based on the [Oracle GraalVM images](https://blogs.oracle.com/java/post/new-oracle-graalvm-container-images), which as of JDK 17, are now under the [GraalVM Free License](https://blogs.oracle.com/java/post/graalvm-free-license) incorporating what used to be known as the GraalVM Enterprise.
+3. Due to these images using Oracle Linux, (which is based on Red Hat Enterprise Linux) Forge Installer will not work due to its use of zlib-ng. Use other images for initial installation and Forge version upgrade.

 !!! example "Example using java8"

@@ -121,7 +126,6 @@ Forge also doesn't support openj9 JVM implementation.

 The following image tags have been deprecated and are no longer receiving updates:

- java25-graalvm, java21-graalvm, java17-graalvm
 - adopt13
 - adopt14
 - adopt15
@@ -4,11 +4,6 @@ services:
    environment:
      EULA: true
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      CF_PAGE_URL: https://www.curseforge.com/minecraft/modpacks/all-of-fabric-7
 #      CF_FILENAME_MATCHER: 1.2.2
      CF_OVERRIDES_EXCLUSIONS: |
@@ -8,11 +8,6 @@ services:
    environment:
      EULA: true
      MOD_PLATFORM: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      CF_SLUG: all-the-mods-10
      # Optional: select a specific version/file
      # CF_FILENAME_MATCHER: "1.17"
@@ -6,11 +6,6 @@ services:
    environment:
      EULA: "true"
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      CF_PAGE_URL: https://www.curseforge.com/minecraft/modpacks/all-the-mods-8
 #      CF_FILENAME_MATCHER: "1.1.0"
      MEMORY: 4G
@@ -6,11 +6,6 @@ services:
    environment:
      EULA: "true"
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      CF_PAGE_URL: https://www.curseforge.com/minecraft/modpacks/all-the-mods-9
      # Optional: select a specific version/file
      #CF_FILENAME_MATCHER: "0.2.34"
@@ -9,7 +9,6 @@ services:
      EULA: true
      ALLOW_FLIGHT: true
      MOD_PLATFORM: AUTO_CURSEFORGE
-      CF_API_KEY: ${CF_API_KEY}
      CF_SLUG: craftoria
      MOTD: |
        A %TYPE% server on %VERSION%
@@ -4,8 +4,6 @@ services:
    environment:
      EULA: "TRUE"
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      CF_API_KEY: ${CF_API_KEY}
      # Example of overriding modloader version for a Fabric modpack
      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
      CF_SLUG: "cobblemon-fabric"
@@ -9,11 +9,6 @@ services:
    environment:
      EULA: "TRUE"
      TYPE: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      CF_PAGE_URL: https://www.curseforge.com/minecraft/modpacks/ftb-evolution
      # This modpack includes an override client-side only mod that will prevent the server from starting.
      # For more information on override exclusions see: 
@@ -4,11 +4,6 @@ services:
    environment:
      EULA: true
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      CF_MODPACK_MANIFEST: /manifests/manifest.json
      CF_SLUG: "custom"
      MEMORY: 2G
@@ -6,11 +6,6 @@ services:
    environment:
      EULA: "true"
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      CF_SLUG: one-block-modded
      # Modpack client zip must be manually downloaded from
      # https://www.curseforge.com/minecraft/modpacks/one-block-modded
@@ -6,11 +6,6 @@ services:
    environment:
      EULA: "true"
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      CF_SLUG: the-pixelmon-modpack
      CF_FILENAME_MATCHER: "9.1.2"
      MEMORY: 4G
@@ -6,11 +6,6 @@ services:
    environment:
      EULA: "true"
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      CF_PAGE_URL: https://www.curseforge.com/minecraft/modpacks/prominence-2-rpg
      CF_FILENAME_MATCHER: "2.8.7"
      MEMORY: 4G
@@ -7,11 +7,6 @@ services:
    environment:
      EULA: "true"
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      CF_PAGE_URL: https://www.curseforge.com/minecraft/modpacks/roguelike-adventures-and-dungeons-2
      # Optional: select a specific version/file
      #CF_FILENAME_MATCHER: "0.2.34"
@@ -6,7 +6,6 @@ services:
      MODPACK_PLATFORM: AUTO_CURSEFORGE
      CF_SLUG: skyfactory-4
      CF_FILENAME_MATCHER: 4.2.4
-      CF_API_KEY: ${CF_API_KEY}
      MEMORY: 3G
    ports:
      - "25565:25565"
@@ -10,11 +10,6 @@ services:
      # Comment out the following to get the latest version or pick a version from
      # https://www.curseforge.com/minecraft/modpacks/skyfactory-5/files/all?page=1&pageSize=20
      CF_FILENAME_MATCHER: 5.0.8
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      MEMORY: 4G
    ports:
      - "25565:25565"
@@ -6,11 +6,6 @@ services:
    environment:
      EULA: "true"
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      CF_PAGE_URL: https://www.curseforge.com/minecraft/modpacks/minecraft-eternal/files/4102634
      MEMORY: 4G
    volumes:
@@ -6,11 +6,6 @@ services:
    environment:
      EULA: "true"
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      CF_FORCE_SYNCHRONIZE: "true"
      CF_PAGE_URL: https://www.curseforge.com/minecraft/modpacks/valhelsia-5/files/4429560
      MEMORY: 4G
@@ -6,11 +6,6 @@ services:
    environment:
      EULA: "true"
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      CF_SLUG: vault-hunters-1-18-2
      MOTD: "§4----- §2 Vault Hunters: 1.18.2 §4 -----§r\\n     §4------ §e vaulthunters.gg  §4------"
      MEMORY: 6G # 4G for base server + 2G per player
@@ -4,11 +4,6 @@ services:
    environment:
      EULA: true
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      CF_SLUG: better-mc-fabric-bmc1
 #      CF_FILENAME_MATCHER: v18.5
      MEMORY: 4G
@@ -4,11 +4,6 @@ services:
    environment:
      EULA: true
      TYPE: FORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      VERSION: 1.19.2
      CURSEFORGE_FILES: |
        geckolib # some comment
@@ -1,6 +1,7 @@
+name: mc-rconcmd
 services:
  minecraft:
-    image: ${IMAGE_TO_TEST:-itzg/minecraft-server}
+    image: itzg/minecraft-server
    ports:
      - "25565:25565"
    volumes:
@@ -12,11 +13,6 @@ services:
      CURSEFORGE_FILES: |
        fabric-api
        chunky-pregenerator
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      # YAML Heredoc, be sure to use '|-' this will remove the first newline and final new line.
      # This is versus '|' that will leaving with two empty strings at top and bottom.
      RCON_CMDS_STARTUP:  |-
@@ -14,6 +14,9 @@ services:
      # GTNH_DELETE_BACKUPS: true
      # Use to prevent updates
      # SKIP_GTNH_UPDATE_CHECK: true
+      # Enable and set Token for daily builds
+      # GTNH_USE_DAILY_BUILD: true
+      # GH_TOKEN: mytoken
      MEMORY: 6G
      # Bring in standard extra mods described at https://wiki.gtnewhorizons.com/wiki/Additional_Mods
 #      MODS: |
@@ -5,11 +5,6 @@ services:
      EULA: true
      TYPE: KETTING
      VERSION: 1.20.1
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: "${CF_API_KEY}"
      CURSEFORGE_FILES: https://www.curseforge.com/minecraft/mc-mods/aquaculture
    ports:
      - "25565:25565"
@@ -4,11 +4,6 @@ services:
    environment:
      EULA: true
      MODPACK_PLATFORM: AUTO_CURSEFORGE
-      # Allocate API key from https://console.curseforge.com/
-      # and set in .env file making sure to double up dollar signs, such as
-      # CF_API_KEY=$$2a$$10$$....
-      # Refer to https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/mod-platforms/auto-curseforge/#api-key
-      CF_API_KEY: ${CF_API_KEY}
      CF_SLUG: rlcraft
      CF_FILENAME_MATCHER: 2.9.3
      CF_FORCE_SYNCHRONIZE: true
@@ -1,12 +1,16 @@
 {
-  "file": "/data/settings.yml",
-  "ops": [
+  "patches": [
    {
-      "$set": {
-        "path": "$.bind.port",
-        "value": "${SERVER_PORT}",
-        "value-type": "int"
-      }
+      "file": "/data/settings.yml",
+      "ops": [
+        {
+          "$set": {
+            "path": "$.bind.port",
+            "value": "${SERVER_PORT}",
+            "value-type": "int"
+          }
+        }
+      ]
    }
  ]
-}
+}
@@ -40,7 +40,7 @@ if ! mc-image-helper network-interfaces --check="$AUTOPAUSE_KNOCK_INTERFACE" ; t
  autopause_error_loop
 fi

-knockdArgs=(-c /tmp/knockd-config.cfg -d -i "$AUTOPAUSE_KNOCK_INTERFACE")
+knockdArgs=(-c /data/.knockd.cfg -d -i "$AUTOPAUSE_KNOCK_INTERFACE")
 if isTrue "${DEBUG_AUTOPAUSE}"; then
  knockdArgs+=(-D)
 fi
@@ -24,13 +24,13 @@ log "Autopause functionality enabled"

 isDebugging && set -x

-cp /image/knockd-config.cfg /tmp/knockd-config.cfg
+cp /image/knockd-config.cfg /data/.knockd.cfg

 function updatePort() {
  regseq="^\s*sequence\s*=\s*$1\s*$"
-  linenum=$(grep -nm${2} sequence /tmp/knockd-config.cfg | cut -d : -f 1 | tail -n1)
-  if ! [[ $(awk "NR==$linenum" /tmp/knockd-config.cfg) =~ $regseq ]]; then
-    sed -i "${linenum}s/sequence.*/sequence = $1/" /tmp/knockd-config.cfg
+  linenum=$(grep -nm${2} sequence /data/.knockd.cfg | cut -d : -f 1 | tail -n1)
+  if ! [[ $(awk "NR==$linenum" /data/.knockd.cfg) =~ $regseq ]]; then
+    sed -i "${linenum}s/sequence.*/sequence = $1/" /data/.knockd.cfg
    log "Updated $3 port in knockd config"
  fi
 }
@@ -67,6 +67,12 @@ fi
 # seq_cooldown cannot be larger than AUTOPAUSE_TIMEOUT_KN, otherwise the server may
 # become paused while knockd is still ignoring packets, preventing players from joining.
 let COOLDOWN=$AUTOPAUSE_TIMEOUT_KN/2
-sed -i "s/\(seq_cooldown *= *\).*/\1$COOLDOWN/" /tmp/knockd-config.cfg
+sed -i "s/\(seq_cooldown *= *\).*/\1$COOLDOWN/" /data/.knockd.cfg
+
+if isDebugging; then
+  echo "Autopause configuration: ======================================"
+  cat /data/.knockd.cfg
+  echo "==============================================================="
+fi

 "$(dirname "$0")/auto/autopause-daemon.sh" &
@@ -7,6 +7,7 @@ IFS=$'\n\t'

 : "${EULA:=}"
 : "${PROXY:=}"
+: "${PREFER_IPV6:=false}"
 : "${ENABLE_AUTOPAUSE:=false}"
 : "${ENABLE_AUTOSTOP:=false}"
 : "${RCON_CMDS_STARTUP:=}"
@@ -28,11 +29,22 @@ shopt -s nullglob

 isDebugging && set -x

+if isTrue "$PREFER_IPV6"; then
+  MC_IMAGE_HELPER_OPTS+="-Djava.net.preferIPv6Addresses=true -Djava.net.preferIPv6Stack=true"
+  export MC_IMAGE_HELPER_OPTS
+  JVM_DD_OPTS+="java.net.preferIPv6Addresses=true java.net.preferIPv6Stack=true"
+  export JVM_DD_OPTS
+fi
+
 if (( $(mc-image-helper java-release) >= 17 )); then
  MC_IMAGE_HELPER_OPTS+=" --enable-native-access=ALL-UNNAMED"
  export MC_IMAGE_HELPER_OPTS
 fi

+if [[ $(getDistro) == alpine ]]; then
+  export LD_PRELOAD=/lib/libgcompat.so.0
+fi
+
 export HOME=/data

 log "Running as uid=$(id -u) gid=$(id -g) with /data as '$(ls -lnd /data)'"
@@ -7,11 +7,13 @@
 function getGTNHdownloadPath(){
  gtnh_download_path=""
  local release_object=""
-  local current_java_version=""
-  current_java_version=$(mc-image-helper java-release)

  # Select release JSON object
-  if [ "$GTNH_PACK_VERSION" == "latest-dev" ]; then
+  # latest-dev will be removed in the future, but is still supported for now.
+  if [ "$GTNH_PACK_VERSION" == "latest-dev" ] || [ "$GTNH_PACK_VERSION" == "latest-beta" ]; then
+    if [ "$GTNH_PACK_VERSION" == "latest-dev" ]; then
+      logWarning "GTNH_PACK_VERSION=latest-dev is deprecated and will be removed in the future."
+    fi
    if ! release_object="$(
      curl -fsSL "https://downloads.gtnewhorizons.com/versions.json" \
        | jq -r '(.versions // .)|to_entries|sort_by(.value.releaseDate)|map(select(.value.title=="Beta release"))|.[-1]'
@@ -46,23 +48,18 @@ function getGTNHdownloadPath(){
  fi
  
  # Select compatible server files for java version
-  if (( current_java_version == 8 )); then
+  if (( java_version == 8 )); then
    gtnh_download_path=$(jq -r '.value.server.java8Url' <<< "$release_object")
    log "Use GTNH Server Java 8 release."
  
-  elif (( current_java_version >= 17 )); then
-    if (( current_java_version > $(jq '.value.maxJavaVersion' <<< "$release_object") )); then
-      logError "Container Java version $current_java_version is not supported by GTNH. Try an older release."
+  elif (( java_version >= 17 )); then
+    if (( java_version > $(jq '.value.maxJavaVersion' <<< "$release_object") )); then
+      logError "Container Java version $java_version is not supported by GTNH. Try an older release."
      exit 1
    fi
  
    gtnh_download_path=$(jq -r '.value.server.java17_2XUrl' <<< "$release_object")
    log "Use GTNH Server Java 17+ release."
-  
-  else
-    logError "Container Java version $current_java_version is not supported by GTNH."
-    exit 1
-  
  fi
  
  if [[ -z $gtnh_download_path ]]; then
@@ -73,6 +70,56 @@ function getGTNHdownloadPath(){

 }

+function getGTNHdownloadOptions(){
+  # Used for GTNH daily build downloads, to pass additional options to the download command.
+  gtnh_download_options=()
+  # Used for dryrun check
+  gtnh_download_path=""
+
+  # Check if GH_TOKEN is set for daily builds
+  if [ -z "$GH_TOKEN" ]; then
+    logError "GH_TOKEN environment variable must be set to use daily builds."
+    exit 1
+  fi
+
+  gtnh_download_options+=( --output-filename )
+
+  # prepare download options as an array to safely append patterns
+  if [ "$GTNH_PACK_VERSION" == "latest" ] || [ "$GTNH_PACK_VERSION" == "latest-dev" ]; then
+    if [ "$GTNH_PACK_VERSION" == "latest-dev" ]; then
+      logWarning "GTNH_PACK_VERSION=latest-dev is deprecated and will be removed in the future."
+    fi
+    gtnh_download_options+=( --workflow=daily-modpack-build.yml )
+    log "Using latest daily build for GTNH server files."
+  elif [ "$GTNH_PACK_VERSION" == "latest-beta" ]; then
+    gtnh_download_options+=( --workflow=daily-modpack-build.yml )
+    logWarning "Using daily build instead of latest beta release for GTNH server files. If this is not intended, set GTNH_USE_DAILY_BUILD=false to use the latest beta release instead."
+  else
+    gtnh_download_options+=( --run-id="$GTNH_PACK_VERSION" )
+    log "Using specific daily build run ID $GTNH_PACK_VERSION for GTNH server files."
+  fi
+
+  # Select compatible server files for java version
+  if (( java_version == 8 )); then
+    log "Use GTNH Server Java 8 release."
+    gtnh_download_options+=( --artifact-pattern='GTNH-daily-\d{4}-\d{2}-\d{2}\+\d+-server-java8\.zip' )
+  
+  elif (( java_version >= 17 )); then
+    log "Use GTNH Server Java 17+ release."
+    gtnh_download_options+=( --artifact-pattern='GTNH-daily-\d{4}-\d{2}-\d{2}\+\d+-server-java17-\d{2}\.zip' )
+  fi
+
+  debug "GTNH daily build download options: ${gtnh_download_options[*]}"
+
+  if ! gtnh_download_path=$(mc-image-helper github download-artifact --no-download "${gtnh_download_options[@]}" GTNewHorizons/DreamAssemblerXXL); then
+    logError "Failed to find a matching daily build for GTNH server files with the specified options."
+    exit 1
+  fi
+
+  debug "GTNH daily build download path: $gtnh_download_path"
+  
+}
+
 function deleteGTNHbackup(){
  log "Start deleting all config backups"
  if ! find . -maxdepth 1 -type d -name 'gtnh-upgrade-*' -exec rm -rf {} + ; then
@@ -81,24 +128,33 @@ function deleteGTNHbackup(){
 }

 function downloadGTNH(){
-  local gtnh_download=""
+  gtnh_download=""
  base_dir=/data/.tmp/gtnh_base

  debug "Creating temporary /data/.tmp/packs folder for GTNH download"
  mkdir -p /data/.tmp/packs
  trap 'rm -rf /data/.tmp' EXIT
-  
-  log "Downloading $gtnh_download_path."
-  if ! gtnh_download=$(mc-image-helper get -o /data/.tmp/packs --output-filename --skip-up-to-date "$gtnh_download_path"); then
-    logError "Failed to download $gtnh_download_path"
-    exit 1
-  fi
-  debug "Downloaded GTNH server files to $gtnh_download"
-
-  # Unpacking Server files into temporary directory
-  log "Unpacking Server Files into $base_dir"
  mkdir -p "${base_dir}"
-  extract "${gtnh_download}" "${base_dir}"
+  
+  if isTrue "$GTNH_USE_DAILY_BUILD"; then
+  log "Downloading Daily Build for GTNH server files."
+    # gtnh_download_options is injecting download parameters -> (--workflow or --run-id) and --artifact-pattern
+    if ! gtnh_download=$(mc-image-helper github download-artifact -o=$base_dir --unzip "${gtnh_download_options[@]}" GTNewHorizons/DreamAssemblerXXL); then
+      logError "Failed to download Daily Build for GTNH server files."
+      exit 1
+    fi
+  else 
+    log "Downloading $gtnh_download_path."
+    if ! gtnh_download=$(mc-image-helper get -o /data/.tmp/packs --output-filename --skip-up-to-date "$gtnh_download_path"); then
+      logError "Failed to download $gtnh_download_path"
+      exit 1
+    fi
+    debug "Downloaded GTNH server files to $gtnh_download"
+
+    # Unpacking Server files into temporary directory
+    log "Unpacking Server Files into $base_dir"
+    extract "${gtnh_download}" "${base_dir}"
+  fi

  # Remove any eula file since container manages it
  debug "Removing eula.txt from $base_dir"
@@ -209,16 +265,23 @@ function handleGTNH() {
  : "${GTNH_PACK_VERSION:=latest}"
  : "${GTNH_DELETE_BACKUPS:=false}"
  : "${SKIP_GTNH_UPDATE_CHECK:=false}"
-  debug "GTNH VAR CHECK: GTNH_DELETE_BACKUPS=$GTNH_DELETE_BACKUPS, GTNH_PACK_VERSION=$GTNH_PACK_VERSION, TYPE=$TYPE, SKIP_GTNH_UPDATE_CHECK=$SKIP_GTNH_UPDATE_CHECK"
+  : "${GTNH_USE_DAILY_BUILD:=false}"
+  
+  debug "GTNH VAR CHECK: GTNH_DELETE_BACKUPS=$GTNH_DELETE_BACKUPS, GTNH_PACK_VERSION=$GTNH_PACK_VERSION,  TYPE=$TYPE, SKIP_GTNH_UPDATE_CHECK=$SKIP_GTNH_UPDATE_CHECK, GTNH_USE_DAILY_BUILD=$GTNH_USE_DAILY_BUILD"

  if isTrue "$GTNH_DELETE_BACKUPS"; then
    deleteGTNHbackup
  fi

-  if [[ -n "$GTNH_PACK_VERSION" ]] && isFalse "$SKIP_GTNH_UPDATE_CHECK" ; then
+  if [[ -n "$GTNH_PACK_VERSION" ]] && isFalse "$SKIP_GTNH_UPDATE_CHECK"; then
    
-    getGTNHdownloadPath
-    log "Server files located! Will proceed update $gtnh_download_path."
+    if isFalse "$GTNH_USE_DAILY_BUILD"; then
+      getGTNHdownloadPath
+      log "Server files located! Will proceed update $gtnh_download_path."
+    else
+      getGTNHdownloadOptions
+      log "Will proceed update with daily build options: ${gtnh_download_options[*]}."
+    fi


    # Decide if update or install is needed or not.
@@ -239,7 +302,7 @@ function handleGTNH() {
      fi

      # Update .gtnh-version
-      basename "$gtnh_download_path" > /data/.gtnh-version
+      basename "$gtnh_download" > /data/.gtnh-version

      # Cleaning up temporary files
      rm -rf /data/.tmp
@@ -158,10 +158,10 @@ traffic:
  # Ignored if -1.0
  maxPacketBytesRate: 2048.0
 EOF
+else
+  mc-image-helper patch --patch-env-prefix "" /image/nanolimbo-settings-patch.json
 fi

-mc-image-helper patch --patch-env-prefix "" /image/nanolimbo-settings-patch.json
-
 export SERVER
 export FAMILY=LIMBO

@@ -5,52 +5,28 @@
 isDebugging && set -x
 set -o pipefail

-resolveVersion
-export SERVER="minecraft_server.${VERSION// /_}.jar"
+resultsFile=/data/.install-vanilla.env

-if [ ! -e "$SERVER" ] || [ -n "$FORCE_REDOWNLOAD" ]; then
-  debug "Finding version manifest for $VERSION"
-  versionManifestUrl=$(get 'https://launchermeta.mojang.com/mc/game/version_manifest.json' | jq --arg VERSION "$VERSION" --raw-output '[.versions[]|select(.id == $VERSION)][0].url')
-  result=$?
-  if [ $result != 0 ]; then
-    logError "Failed to obtain version manifest URL ($result)"
-    exit 1
-  fi
-  if [ "$versionManifestUrl" = "null" ]; then
-    logError "Couldn't find a matching manifest entry for $VERSION"
-    exit 1
-  fi
-  debug "Found version manifest at $versionManifestUrl"
+args=(
+  --output-directory=/data
+  --results-file="${resultsFile}"
+  --version="${VERSION}"
+)

-  if ! serverDownloadUrl=$(get --json-path '$.downloads.server.url' "${versionManifestUrl}"); then
-    logError "Failed to obtain version manifest from $versionManifestUrl ($result)"
-    exit 1
-  elif [ "$serverDownloadUrl" = "null" ]; then
-    logError "There is not a server download for version $VERSION"
-    exit 1
-  fi
-
-  log "Downloading $VERSION server..."
-  debug "Downloading server from $serverDownloadUrl"
-  get -o "$SERVER" "$serverDownloadUrl"
-  result=$?
-  if [ $result != 0 ]; then
-    logError "Failed to download server from $serverDownloadUrl ($result)"
-    exit 1
-  fi
+if isTrue "${FORCE_REDOWNLOAD}"; then
+  log "Forcing re-install of Minecraft"
+  args+=(--force-reinstall)
 fi
-minecraftServerJarPath=/data/minecraft_server.jar

-if versionLessThan 1.6; then
-  if ! [[ -L $minecraftServerJarPath && $minecraftServerJarPath -ef "/data/$SERVER" ]]; then
-    rm -f $minecraftServerJarPath
-    ln -s "/data/$SERVER" $minecraftServerJarPath
-  fi
-  SERVER=minecraft_server.jar
-elif [[ -L $minecraftServerJarPath ]]; then
-  rm -f $minecraftServerJarPath
+if ! mc-image-helper install-vanilla "${args[@]}"; then
+  logError "Failed to install vanilla Minecraft version $VERSION"
+  exit 1
 fi

+applyResultsFile "${resultsFile}"
+
+log "Successfully setup vanilla Minecraft version $VERSION"
+
 isDebugging && ls -l
 export FAMILY=VANILLA
 exec "$(dirname "$0")/start-setupWorld" "$@"
@@ -3,6 +3,7 @@
 : "${DEBUG_EXEC:=false}"
 : "${SETUP_ONLY:=false}"
 : "${CUSTOM_JAR_EXEC:=}"
+: "${SERVER_RUNNER:=mc-server-runner}"

 # shellcheck source=start-utils
 . "$(dirname "$0")/start-utils"
@@ -96,7 +97,7 @@ fi
 if versionLessThan 1.7; then
  : # No patch required here.
 elif versionLessThan 1.18.1; then
-  if isTrue ${SKIP_LOG4J_PATCHER:-false}; then
+  if isTrue "${SKIP_LOG4J_PATCHER:-false}"; then
    log "Skipping Log4jPatcher, make sure you are not affected"
  else
    JVM_OPTS="-javaagent:/image/Log4jPatcher.jar ${JVM_OPTS}"
@@ -212,8 +213,11 @@ fi
 : "${USE_MEOWICE_FLAGS:=false}"
 : "${USE_MEOWICE_GRAALVM_FLAGS:=false}"

-if isTrue "${USE_MEOWICE_FLAGS}"; then
+if isTrue "${USE_MEOWICE_FLAGS}" || isTrue "${USE_MEOWICE_GRAALVM_FLAGS}"; then
  java_major_version=$(mc-image-helper java-release)
+fi
+
+if isTrue "${USE_MEOWICE_FLAGS}"; then
  if [[ $java_major_version -gt 16 ]]; then
    log "Java version $java_major_version using MeowIce's flags for Java 17+"
  else
@@ -343,6 +347,11 @@ if isTrue "${USE_MEOWICE_FLAGS}"; then
  else
    log "cpu not x86_64, disabling architecture specific flags"
  fi
+  if [[ $java_major_version -gt 23 ]]; then
+    JVM_XX_OPTS="${JVM_XX_OPTS}
+    -XX:+UseCompactObjectHeaders
+    "
+  fi
 fi

 if isTrue "${USE_MEOWICE_GRAALVM_FLAGS}"; then
@@ -496,7 +505,7 @@ if [[ ${TYPE} == "CURSEFORGE" && "${SERVER}" ]]; then
  if isTrue "${DEBUG_EXEC}"; then
    set -x
  fi
-  exec mc-server-runner ${bootstrapArgs} "${mcServerRunnerArgs[@]}" java $JVM_XX_OPTS $JVM_OPTS $expandedDOpts -jar "$(basename "${SERVER}")" "$@" $EXTRA_ARGS
+  exec ${SERVER_RUNNER} ${bootstrapArgs} "${mcServerRunnerArgs[@]}" -- java $JVM_XX_OPTS $JVM_OPTS $expandedDOpts -jar "$(basename "${SERVER}")" "$@" $EXTRA_ARGS
 elif [[ ${TYPE} == "CURSEFORGE" ]]; then
  mcServerRunnerArgs+=(--shell bash)

@@ -550,18 +559,18 @@ fi
      JVM_ARGS=${JVM_ARGS//$'\n'/}
      sed -i "s~JAVA_ARGS=.*~JAVA_ARGS=\"${JVM_ARGS}\"~" "${FTB_DIR}/variables.txt"
  fi
-  exec mc-server-runner "${mcServerRunnerArgs[@]}" "${finalArgs[@]}"
+  exec ${SERVER_RUNNER} "${mcServerRunnerArgs[@]}" -- "${finalArgs[@]}"
 elif [[ $SERVER =~ run.sh ]]; then
  log "Using Forge supplied run.sh script..."
  echo $JVM_XX_OPTS $JVM_OPTS $expandedDOpts > user_jvm_args.txt
-  if isTrue ${SETUP_ONLY}; then
+  if isTrue "${SETUP_ONLY}"; then
    echo "SETUP_ONLY: bash ${SERVER}"
    exit
  fi
  if isTrue "${DEBUG_EXEC}"; then
    set -x
  fi
-  exec mc-server-runner "${mcServerRunnerArgs[@]}" --shell bash "${SERVER}" $EXTRA_ARGS
+  exec ${SERVER_RUNNER} "${mcServerRunnerArgs[@]}" --shell bash -- "${SERVER}" $EXTRA_ARGS
 else
  # If we have a bootstrap.txt file... feed that in to the server stdin
  if [ -f $bootstrapPath ]; then
@@ -590,7 +599,7 @@ else
    "$@" $EXTRA_ARGS
  )

-  if isTrue ${SETUP_ONLY}; then
+  if isTrue "${SETUP_ONLY}"; then
    echo "SETUP_ONLY: java ${finalArgs[*]}"
    exit
  fi
@@ -599,5 +608,5 @@ else
    set -x
  fi

-  exec mc-server-runner ${bootstrapArgs} "${mcServerRunnerArgs[@]}" java "${finalArgs[@]}"
+  exec ${SERVER_RUNNER} ${bootstrapArgs} "${mcServerRunnerArgs[@]}" -- java "${finalArgs[@]}"
 fi
@@ -15,7 +15,6 @@ set -e -o pipefail

 # shellcheck source=start-utils
 . "$(dirname "$0")/start-utils"
-isDebugging && set -x

 if [[ -n ${CF_API_KEY_FILE} ]]; then
  if [[ -r "${CF_API_KEY_FILE}" ]]; then
@@ -27,6 +26,8 @@ if [[ -n ${CF_API_KEY_FILE} ]]; then
  fi
 fi

+isDebugging && set -x
+
 sum_file=/data/.generic_pack.sum
 # Remove old mods/plugins
 if isTrue "${REMOVE_OLD_MODS}" && [ -z "${MODS_FILE}" ]; then
@@ -181,7 +182,38 @@ function handleGenericPacks() {
    packFiles=()
    for packEntry in "${packs[@]}"; do
      pack="${GENERIC_PACKS_PREFIX}${packEntry}${GENERIC_PACKS_SUFFIX}"
-      if isURL "${pack}"; then
+      if isOCIRef "${pack}"; then
+        # All OCI refs share one staging dir so layers common to multiple
+        # sibling artifacts (the point of layered distribution) are pulled
+        # exactly once across all of GENERIC_PACKS.
+        mkdir -p /data/packs/oci /data/.tmp
+        log "Pulling OCI generic pack from $pack"
+        # A list file is used rather than stdout because mc-image-helper INFO
+        # logs share that stream; it holds one absolute layer path per line in
+        # apply order.
+        layerListFile=$(mktemp -p /data/.tmp)
+        ociArgs=(install-oci-pack
+          --ref "$pack"
+          --output-directory /data/packs/oci
+          --filename-strategy digest
+          --layer-list-file "$layerListFile")
+        if [[ "${GENERIC_PACKS_OCI_AUTH_FILE:-}" ]]; then
+          ociArgs+=(--auth-file "${GENERIC_PACKS_OCI_AUTH_FILE}")
+        fi
+        if ! mc-image-helper "${ociArgs[@]}"; then
+          logError "Failed to pull OCI generic pack $pack"
+          logError "(OCI generic packs require mc-image-helper with install-oci-pack support)"
+          rm -f "$layerListFile"
+          exit 2
+        fi
+        mapfile -t ociLayers < "$layerListFile"
+        rm -f "$layerListFile"
+        if [ ${#ociLayers[@]} -eq 0 ]; then
+          logError "OCI generic pack $pack resolved to zero layers"
+          exit 2
+        fi
+        packFiles+=("${ociLayers[@]}")
+      elif isURL "${pack}"; then
        mkdir -p /data/packs
        log "Downloading generic pack from $pack"
        if ! outfile=$(get -o /data/packs --output-filename --skip-up-to-date "$pack"); then
@@ -173,6 +173,12 @@ function isURL() {
  [[ $value =~ ^(https?|ftp):// ]]
 }

+function isOCIRef() {
+  local value=$1
+
+  [[ $value =~ ^oci:// ]]
+}
+
 function isValidFileURL() {
  suffix=${1:?Missing required suffix arg}
  url=${2:?Missing required url arg}
@@ -0,0 +1,18 @@
+services:
+  mc:
+    image: ${IMAGE_TO_TEST:-itzg/minecraft-server}
+    environment:
+      EULA: "true"
+      SETUP_ONLY: "true"
+      # two OCI packs that share a common base layer; the shared blob is
+      # pulled into /data/packs/oci once and reused for the second pack
+      GENERIC_PACKS: oci://ghcr.io/itzg/oci-modpack-template/tech:latest,oci://ghcr.io/itzg/oci-modpack-template/magic:latest
+      LOG_TIMESTAMP: "true"
+      # the following are only used to speed up test execution
+      TYPE: CUSTOM
+      CUSTOM_SERVER: /servers/fake.jar
+      VERSION: 1.18.1
+      DEBUG: "true"
+    volumes:
+      - ./data:/data
+      - ./fake.jar:/servers/fake.jar
@@ -0,0 +1 @@
+[[ $EXTENDED_TESTS ]] || exit 1
@@ -0,0 +1,7 @@
+set -e
+# OCI layers were cached
+[ -d /data/packs/oci ]
+compgen -G "/data/packs/oci/sha256:*" > /dev/null
+# pack content was extracted and applied to /data
+[ -d /data/mods ]
+compgen -G "/data/mods/*" > /dev/null
@@ -0,0 +1,23 @@
+services:
+  # copies seed/ into /data before mc starts, so the NanoLimbo setup takes its
+  # "settings.yml already exists" path instead of writing the template
+  seed:
+    restart: "no"
+    image: ${IMAGE_TO_TEST:-itzg/minecraft-server}
+    entrypoint: ["bash", "-c", "cp /seed/settings.yml /data/ && chown -R 1000:1000 /data"]
+    volumes:
+      - ./seed:/seed
+      - ./data:/data
+
+  mc:
+    restart: "no"
+    image: ${IMAGE_TO_TEST:-itzg/minecraft-server}
+    depends_on:
+      seed:
+        condition: service_completed_successfully
+    environment:
+      EULA: "TRUE"
+      TYPE: NANOLIMBO
+      SERVER_PORT: "25599"
+    volumes:
+      - ./data:/data
@@ -0,0 +1,4 @@
+bind:
+  ip: '0.0.0.0'
+  port: 25565
+maxPlayers: 100
@@ -0,0 +1,4 @@
+set -e
+# SERVER_PORT must have been applied to the settings.yml that was already there
+port=$(mc-image-helper yaml-path --file /data/settings.yml .bind.port)
+[ "$port" = 25599 ] || { echo "expected bind.port 25599 but was '$port'"; exit 1; }
Author	SHA1	Message	Date
renovate[bot]andGitHub	1e2d375dba	Update dependency itzg/mc-image-helper to v1.64.1 (#4213 )	2026-08-03 21:50:05 -05:00
Geoff BourneandGitHub	865d8e89cd	Enhance SECURITY.md with automated scan information (#4212 )	2026-08-03 14:30:13 -05:00
OowhitecatoOandGitHub	8651291543	Enable compact object headers on Java 24+ (#4211 )	2026-08-03 07:10:14 -05:00
renovate[bot]andGitHub	ec489685e3	Update dependency itzg/mc-monitor to v0.17.0 (#4209 )	2026-08-02 16:12:38 -05:00
OowhitecatoOandGitHub	0f809e27bb	Restore the GraalVM image variants (#4205 )	2026-08-02 06:54:08 -05:00
Geoff BourneandGitHub	d85904036f	Ensure debugging starts after loading CF_API_KEY_FILE (#4208 )	2026-08-01 09:33:18 -05:00
Geoff BourneandGitHub	fa1b930094	Add SECURITY.md for security policy and reporting (#4207 )	2026-08-01 09:09:00 -05:00
OowhitecatoOandGitHub	6fa08c7067	Fix GraalVM flag selection when USE_MEOWICE_FLAGS is not set (#4204 )	2026-08-01 07:44:30 -05:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	56c6635604	Update dependency itzg/mc-image-helper to v1.64.0 (#4202 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-07-31 21:25:48 -05:00
OowhitecatoOandGitHub	1e4602a82e	Fix build workflow conditionals that always evaluated true (#4203 )	2026-07-31 15:50:08 -05:00
OowhitecatoOandGitHub	749f8f635f	Fix NanoLimbo port not applying to an existing settings.yml (#4201 )	2026-07-31 07:56:18 -05:00
renovate[bot]andGitHub	8fde0cac2a	Update dependency itzg/mc-image-helper to v1.63.2 (#4198 )	2026-07-30 17:07:45 -05:00
dependabot[bot]andGitHub	162bd9b5f1	build(deps): bump docker/login-action from 4.4.0 to 4.5.2 in the updates group (#4195 )	2026-07-29 08:06:30 -05:00
dependabot[bot]andGitHub	614d3f481b	build(deps): bump actions/stale from 10 to 11 (#4196 )	2026-07-29 07:01:03 -05:00
JasperandGitHub	ca381904ad	docs: add seedloaf sponsor (#4197 )	2026-07-29 06:52:47 -05:00
Geoff BourneandGitHub	9a2348cadd	Use Metalcape knockd by default for java25 (#4194 )	2026-07-27 13:40:32 -05:00
Geoff BourneandGitHub	33159ddd83	Move knockd config out of /tmp (#4193 )	2026-07-27 11:09:57 -05:00
Leon KampwerthandGitHub	7e1c26a18f	Add daily build options to gtnh example (#4191 )	2026-07-25 22:52:09 -05:00
Leon Kampwerth GitHub SgtMate	0459532398	Implement GTNH daily build support (#4190 ) Co-authored-by: SgtMate <SgtMate@users.noreply.github.com>	2026-07-24 18:06:52 -05:00
renovate[bot]andGitHub	99d4481c01	Update dependency itzg/mc-image-helper to v1.63.1 (#4189 )	2026-07-23 14:48:40 -05:00
dependabot[bot]andGitHub	194accb407	build(deps): bump the patches group in /docs with 2 updates (#4187 )	2026-07-22 07:20:45 -05:00
renovate[bot]andGitHub	7f1affbcd8	Update dependency itzg/mc-image-helper to v1.63.0 (#4184 )	2026-07-20 14:25:08 -05:00
Geoff BourneandGitHub	4cbdf520c8	Revert "Switch to permissions for auto-release workflow" (#4185 )	2026-07-20 13:45:20 -05:00
Geoff BourneandGitHub	a3bb7bff34	SERVER_RUNNER is expanded when exec'ed (#4183 )	2026-07-19 21:35:08 -05:00
Geoff BourneandGitHub	1e77b81b32	Allow for custom SERVER_RUNNER (#4182 )	2026-07-19 20:37:26 -05:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	479973c950	Update dependency itzg/mc-image-helper to v1.62.1 (#4180 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-07-19 19:06:29 -05:00
Geoff BourneandGitHub	2a246ee805	Added PREFER_IPv6 to simplify Java setup for IPv6 addresses and stack (#4181 )	2026-07-19 16:10:01 -05:00
Josh Cotton GitHub Geoff Bourne	3c4c94e1ad	Use mc-image-helper to install vanilla Minecraft. (#4165 ) Co-authored-by: Geoff Bourne <itzgeoff@gmail.com>	2026-07-19 15:54:07 -05:00
Geoff BourneandGitHub	cd2c5628f2	Enhance workflow conditionals for forked repositories and notifications (#4179 )	2026-07-18 16:51:16 -05:00
Geoff BourneandGitHub	0a445cd8db	Only trigger auto release for non-forked (#4178 )	2026-07-18 15:02:29 -05:00
Geoff BourneandGitHub	537a3e43fe	Use gcompat to ensure mc-image-helper runs on aarch64+alpine (#4176 )	2026-07-17 07:54:30 -05:00
Geoff BourneandGitHub	17d7f01267	Corrected the "must" wording for API key with CURSEFORGE_FILES (#4174 )	2026-07-16 17:57:48 -05:00
Chip Wolf ‮andGitHub	591f37bfa5	generic-packs: support oci:// references via install-oci-pack (#4164 )	2026-07-16 17:29:05 -05:00
Geoff BourneandGitHub	3302bdb3cb	Notify on PR merged (#4173 )	2026-07-16 10:16:17 -05:00
Geoff BourneandGitHub	fe9f471da7	CF_API_KEY is now baked in and available by default (#4172 )	2026-07-16 09:56:52 -05:00