Auto-merging via docker-versions-create

As described in https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition,
versions below 1.7 are not affected by the log4j exploit. They should therefore not use any mitigations.

See #1179 discussion after merge.

Reported-and-tested-by: Daniel Porter "Stealthii" <dan.porter@rehabstudio.com>

.github/workflows/build-multiarch.yml

@@ -9,6 +9,7 @@ on:
       - java16*
       - java17*
       - test/*
+      - fix/*
     tags:
       - "[0-9]+.[0-9]+.[0-9]+"
       - "[0-9]+.[0-9]+.[0-9]+-java8-multiarch"
@@ -20,8 +21,11 @@ on:
       - "docs/**"
       - "examples/**"
 
+env:
+  IMAGE_TO_TEST: itzg/minecraft-server:test-${{ github.repository_owner }}-${{ github.run_id }}
+
 jobs:
-  docker-buildx:
+  build:
     if: github.repository == 'itzg/docker-minecraft-server'
     runs-on: ubuntu-20.04
     steps:
@@ -43,14 +47,6 @@ jobs:
       - name: Setup Docker Buildx
         uses: docker/setup-buildx-action@v1
 
-      - name: Cache Docker layers
-        uses: actions/cache@v2.1.6
-        with:
-          path: /tmp/.buildx-cache
-          key: ${{ runner.os }}-buildx-${{ github.sha }}
-          restore-keys: |
-            ${{ runner.os }}-buildx-
-
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1.2.0
 
@@ -60,27 +56,39 @@ jobs:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
+      - name: Build for test
+        uses: docker/build-push-action@v2.7.0
+        if: github.ref_name == 'master'
+        with:
+          context: .
+          platforms: linux/amd64
+          tags: ${{ env.IMAGE_TO_TEST }}
+          # ensure latest base image is used
+          pull: true
+          load: true
+          push: false
+          cache-from: type=gha
+          # no cache-to to avoid cross-cache update from next build step
+
+      - name: Run tests
+        # It is assumed that image variants are merged from master and tested there
+        if: github.ref_name == 'master'
+        run: |
+          tests/test.sh
+
       - name: Build and push
         id: docker_build
         uses: docker/build-push-action@v2.7.0
         with:
           context: .
-          platforms: linux/amd64,linux/arm/v7,linux/arm64
+          platforms: linux/amd64
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           # ensure latest base image is used
           pull: true
-          cache-from: type=local,src=/tmp/.buildx-cache
-          cache-to: type=local,dest=/tmp/.buildx-cache-new
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           labels: ${{ steps.meta.outputs.labels }}
 
       - name: Image digest
         run: echo ${{ steps.docker_build.outputs.digest }}
-
-      - # Temp fix
-        # https://github.com/docker/build-push-action/issues/252
-        # https://github.com/moby/buildkit/issues/1896
-        name: Move cache
-        run: |
-          rm -rf /tmp/.buildx-cache
-          mv /tmp/.buildx-cache-new /tmp/.buildx-cache

.github/workflows/main.yml

@@ -15,19 +15,11 @@ on:
       - "[0-9]+.[0-9]+.[0-9]+-openj9-nightly"
       - "[0-9]+.[0-9]+.[0-9]+-adopt11"
 
+env:
+  IMAGE_TO_TEST: itzg/minecraft-server:test-${{ github.repository_owner }}-${{ github.run_id }}
+
 jobs:
-  test:
-    runs-on: ubuntu-20.04
-
-    steps:
-      - uses: actions/checkout@v2.4.0
-
-      - name: Run tests
-        run: |
-          tests/test.sh
   build:
-    needs:
-      - test
     runs-on: ubuntu-20.04
 
     steps:
@@ -54,20 +46,33 @@ jobs:
     - name: Setup Docker Buildx
       uses: docker/setup-buildx-action@v1
 
-    - name: Cache Docker layers
-      uses: actions/cache@v2.1.6
-      with:
-        path: /tmp/.buildx-cache
-        key: ${{ runner.os }}-buildx-${{ github.sha }}
-        restore-keys: |
-          ${{ runner.os }}-buildx-
-
     - name: Login to DockerHub
       uses: docker/login-action@v1
       with:
         username: ${{ secrets.DOCKER_USER }}
         password: ${{ secrets.DOCKER_PASSWORD }}
 
+    - name: Build for test
+      uses: docker/build-push-action@v2.7.0
+      if: github.ref_name == 'java8'
+      with:
+        context: .
+        platforms: linux/amd64
+        tags: ${{ env.IMAGE_TO_TEST }}
+        # ensure latest base image is used
+        pull: true
+        load: true
+        push: false
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+
+    - name: Run tests
+      if: github.ref_name == 'java8'
+      run: |
+        tests/test.sh
+      env:
+        MINECRAFT_VERSION: 1.12.2
+
     - name: Build and push
       id: docker_build
       uses: docker/build-push-action@v2.7.0
@@ -80,8 +85,8 @@ jobs:
         push: true
         # tags determined by prep step
         tags: ${{ steps.prep.outputs.tags }}
-        cache-from: type=local,src=/tmp/.buildx-cache
-        cache-to: type=local,dest=/tmp/.buildx-cache-new
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
         labels: |
           org.opencontainers.image.documentation=https://github.com/itzg/docker-minecraft-server
           org.opencontainers.image.version=${{ steps.prep.outputs.version }}
@@ -90,11 +95,3 @@ jobs:
 
     - name: Image digest
       run: echo ${{ steps.docker_build.outputs.digest }}
-
-    - # Temp fix
-      # https://github.com/docker/build-push-action/issues/252
-      # https://github.com/moby/buildkit/issues/1896
-      name: Move cache
-      run: |
-        rm -rf /tmp/.buildx-cache
-        mv /tmp/.buildx-cache-new /tmp/.buildx-cache

.github/workflows/pr.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ master ]
 
+env:
+  IMAGE_TO_TEST: itzg/minecraft-server:test-${{ github.repository_owner }}-${{ github.run_id }}
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -11,6 +14,19 @@ jobs:
     steps:
       - uses: actions/checkout@v2.4.0
 
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Build
+        uses: docker/build-push-action@v2.7.0
+        with:
+          context: .
+          platforms: linux/amd64
+          tags: ${{ env.IMAGE_TO_TEST }}
+          load: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
       - name: Run tests
         run: |
           tests/test.sh

.github/workflows/stale-check.yml

@@ -1,7 +1,6 @@
 name: Stale Check
 
 on:
-  issue_comment:
   schedule:
     - cron: 0 2 * * *
 

DEVELOPMENT.md

@@ -93,5 +93,27 @@ The multiarch images are built and published by [a Github action](https://github
 The following git command can be used to provide the bulk of release notes content:
 
 ```shell script
-git log --invert-grep --grep "^ci:" --grep "^misc:" --grep "^docs:" --pretty="- %s" 1.1.0..1.2.0
+git log --invert-grep --grep "^ci:" --grep "^misc:" --grep "^docs:" --pretty="* %s" 1.1.0..1.2.0
 ```
+## Tracking changes from master without content
+
+The following script uses the [ours](https://git-scm.com/docs/merge-strategies#Documentation/merge-strategies.txt-ours) merging strategy to track the history from master into the other branches without actually bringing the changes over. It is useful when a change is specific to master only, such as bumping the base Java version for the `latest` image tag.
+
+```shell
+branches=(
+  java8
+  java8-multiarch
+  java8-openj9
+  java11
+  java11-openj9
+  java16
+  java16-openj9
+  java17
+)
+
+for b in "${branches[@]}"; do
+  git checkout "$b"
+  git merge -s ours -m "Track latest from master" master
+  git push origin
+done
+```

Dockerfile

@@ -1,4 +1,4 @@
-FROM eclipse-temurin:8-jdk
+FROM adoptopenjdk:8-jdk-openj9
 
 LABEL org.opencontainers.image.authors="Geoff Bourne <itzgeoff@gmail.com>"
 
@@ -49,7 +49,7 @@ RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
  --from https://github.com/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
 RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
- --var version=0.10.1 --var app=mc-monitor --file {{.app}} \
+ --var version=0.10.3 --var app=mc-monitor --file {{.app}} \
  --from https://github.com/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
 RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
@@ -60,7 +60,7 @@ RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
  --var version=0.1.1 --var app=maven-metadata-release --file {{.app}} \
  --from https://github.com/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
-ARG MC_HELPER_VERSION=1.9.6
+ARG MC_HELPER_VERSION=1.10.0
 ARG MC_HELPER_BASE_URL=https://github.com/itzg/mc-image-helper/releases/download/v${MC_HELPER_VERSION}
 RUN curl -fsSL ${MC_HELPER_BASE_URL}/mc-image-helper-${MC_HELPER_VERSION}.tgz \
     | tar -C /usr/share -zxf - \

README.md

@@ -41,6 +41,7 @@ By default, the container will download the latest version of the "vanilla" [Min
    * [Troubleshooting](#troubleshooting)
    * [Server types](#server-types)
       * [Running a Forge Server](#running-a-forge-server)
+      * [Running a Fabric Server](#running-a-fabric-server)
       * [Running a Bukkit/Spigot server](#running-a-bukkitspigot-server)
       * [Running a Paper server](#running-a-paper-server)
       * [Running an Airplane server](#running-an-airplane-server)
@@ -48,9 +49,8 @@ By default, the container will download the latest version of the "vanilla" [Min
       * [Running a Magma server](#running-a-magma-server)
       * [Running a Mohist server](#running-a-mohist-server)
       * [Running a Catserver type server](#running-a-catserver-type-server)
-      * [Running an Canyon server](#running-an-canyon-server)
+      * [Running a Canyon server](#running-a-canyon-server)
       * [Running a SpongeVanilla server](#running-a-spongevanilla-server)
-      * [Running a Fabric Server](#running-a-fabric-server)
       * [Running a Limbo server](#running-a-limbo-server)
       * [Running a Crucible server](#running-a-crucible-server)
    * [Running a server with a Feed the Beast modpack](#running-a-server-with-a-feed-the-beast-modpack)
@@ -61,10 +61,11 @@ By default, the container will download the latest version of the "vanilla" [Min
       * [Modpack data directory](#modpack-data-directory)
       * [Buggy start scripts](#buggy-start-scripts)
       * [Fixing "unable to launch forgemodloader"](#fixing-unable-to-launch-forgemodloader)
+   * [Running a server with a packwiz modpack](#running-a-server-with-a-packwiz-modpack)
    * [Working with mods and plugins](#working-with-mods-and-plugins)
       * [Optional plugins, mods, and config attach points](#optional-plugins-mods-and-config-attach-points)
       * [Auto-downloading SpigotMC/Bukkit/PaperMC plugins](#auto-downloading-spigotmcbukkitpapermc-plugins)
-      * [Downloadable mod/plugin pack for Forge, Bukkit, and Spigot Servers](#downloadable-modplugin-pack-for-forge-bukkit-and-spigot-servers)
+      * [Downloadable mod/plugin pack for Forge, Fabric, and Bukkit-like Servers](#downloadable-modplugin-pack-for-forge-fabric-and-bukkit-like-servers)
       * [Generic pack file](#generic-pack-file)
       * [Mod/Plugin URL Listing File](#modplugin-url-listing-file)
       * [Remove old mods/plugins](#remove-old-modsplugins)
@@ -133,7 +134,7 @@ By default, the container will download the latest version of the "vanilla" [Min
    * [Running on RaspberryPi](#running-on-raspberrypi)
    * [Contributing](#contributing)
 
-<!-- Added by: runner, at: Tue Nov 16 02:46:53 UTC 2021 -->
+<!-- Added by: runner, at: Sat Dec 11 22:09:10 UTC 2021 -->
 
 <!--te-->
 
@@ -270,7 +271,7 @@ the server jar remain in the `/data` directory. It is safe to remove those._
 
 ## Running Minecraft server on different Java version
 
-To use a different version of Java, please use a docker tag to run your Minecraft server.
+When using the image `itzg:/minecraft-server` without a tag, the `latest` image tag is implied from the table below. To use a different version of Java, please use an alternate tag to run your Minecraft server container.
 
 | Tag name       | Java version | Linux  | JVM Type | Architecture      |
 | -------------- | -------------|--------|----------|-------------------|
@@ -280,15 +281,16 @@ To use a different version of Java, please use a docker tag to run your Minecraf
 | java8-openj9   | 8            | Debian | OpenJ9   | amd64             |
 | java11         | 11           | Debian | Hotspot  | amd64,arm64,armv7 |
 | java11-openj9  | 11           | Debian | OpenJ9   | amd64             |
-| java16         | 16           | Debian | Hotspot  | amd64,arm64,armv7 |
 | java16-openj9  | 16           | Debian | OpenJ9   | amd64             |
 | java17         | 17           | Ubuntu | Hotspot  | amd64,arm64,armv7 |
 
-For example, to use Java version 16 on any supported architecture:
+For example, to use Java version 8 on any supported architecture:
 
-    docker run --name mc itzg/minecraft-server:java16
+    docker run --name mc itzg/minecraft-server:java8-multiarch
 
 > Keep in mind that some versions of Minecraft server, such as Forge before 1.17, can't work on the newest versions of Java. Instead, one of the Java 8 images should be used. Also, FORGE doesn't support openj9 JVM implementation.
+> 
+> Some versions of vanilla Minecraft, such as 1.10, also do not run correctly with Java 17. If in doubt, use `java8-multiarch` for any version less than 1.17.
 
 ### Deprecated Image Tags
 
@@ -298,6 +300,7 @@ The following image tags have been deprecated and are no longer receiving update
 - adopt15
 - openj9-nightly
 - multiarch-latest
+- java16
 
 ## Healthcheck
 
@@ -400,6 +403,30 @@ the URL with `FORGE_INSTALLER_URL`, such as:
 
 In both of the cases above, there is no need for the `VERSION` or `FORGEVERSION` variables.
 
+### Running a Fabric Server
+
+Enable [Fabric server](https://fabricmc.net/) mode by adding a `-e TYPE=FABRIC` to your command-line. By default, the container will install the latest [fabric-loader](https://fabricmc.net/wiki/documentation:fabric_loader) using the latest [fabric-installer](https://fabricmc.net/use/), against the minecraft server version you have defined with `VERSION` (defaulting to the latest vanilla release of the game).
+
+```
+docker run -d -v /path/on/host:/data \
+    -e TYPE=FABRIC \
+    -p 25565:25565 -e EULA=TRUE --name mc itzg/minecraft-server
+```
+
+See the [Working with mods and plugins](#working-with-mods-and-plugins) section to set up Fabric mods and configuration.
+
+A specific loader version other than the latest can be requested using `FABRIC_LOADER_VERSION`, such as:
+
+```
+docker run -d -v /path/on/host:/data ... \
+    -e FABRIC_LOADER_VERSION=0.12.8
+```
+
+If you wish to use an alternative installer you can:
+* Specify an alternative version using `FABRIC_INSTALLER_VERSION` (such as `-e FABRIC_INSTALLER_VERSION=0.10.2`)
+* Provide the path to a custom installer jar available to the container with `FABRIC_INSTALLER`, relative to `/data` (such as `-e FABRIC_INSTALLER=fabric-installer-0.5.0.32.jar`)
+* Provide the URL to a custom installer jar with `FABRIC_INSTALLER_URL` (such as `-e FABRIC_INSTALLER_URL=http://HOST/fabric-installer-0.5.0.32.jar`)
+
 ### Running a Bukkit/Spigot server
 
 Enable Bukkit/Spigot server mode by adding a `-e TYPE=BUKKIT` or `-e TYPE=SPIGOT` to your command-line.
@@ -482,8 +509,6 @@ By default, the "stable" channel is used, but you can set `MAGMA_CHANNEL` to "de
 
 ### Running a Mohist server
 
-> **CAUTION** Be sure to [read this article](https://essentialsx.net/do-not-use-mohist.html) to understand the risks associated with using Mohist.
-
 A [Mohist](https://github.com/MohistMC/Mohist) server can be used with
 
     -e TYPE=MOHIST
@@ -502,17 +527,15 @@ A [Catserver](http://catserver.moe/) type server can be used with
 
 > **NOTE** Catserver only provides a single release stream, so `VERSION` is ignored
 
-### Running an Canyon server
+### Running a Canyon server
 
 [Canyon](https://github.com/canyonmodded/canyon) is a fork of CraftBukkit for Minecraft Beta 1.7.3. It includes multiple enhancements whilst also retaining compatibility with old Bukkit plugins and mods as much as possible.
 
     -e VERSION=b1.7.3 -e TYPE=CANYON
 
-> **NOTE** only `VERSION=b1.7.3` is supported
+> **NOTE** only `VERSION=b1.7.3` is supported. Since that version pre-dates the health check mechanism used by this image, that will need to be disabled by setting `DISABLE_HEALTHCHECK=true`.
 
-> **NOTE** only Java 8 is supported
-
-By default the latest build will be used; however, a specific build number can be selected by setting `CANYON_BUILD`, such as
+By default, the latest build will be used; however, a specific build number can be selected by setting `CANYON_BUILD`, such as
 
     -e CANYON_BUILD=11
 
@@ -534,39 +557,6 @@ Just change it with `SPONGEBRANCH`, such as:
     $ docker run -d -v /path/on/host:/data ... \
         -e TYPE=SPONGEVANILLA -e SPONGEBRANCH=EXPERIMENTAL ...
 
-### Running a Fabric Server
-
-Enable [Fabric server](http://fabricmc.net/use/) mode by adding a `-e TYPE=FABRIC` to your command-line. By default, the container will run the latest version, but you can also choose to run a specific version with `VERSION`.
-
-```
-docker run -d -v /path/on/host:/data \
-    -e TYPE=FABRIC \
-    -p 25565:25565 -e EULA=TRUE --name mc itzg/minecraft-server
-```
-
-A specific installer version can be requested using `FABRIC_INSTALLER_VERSION`.
-
-To use a pre-downloaded Fabric installer, place it in a directory attached into the container, such as the `/data` volume and specify the name of the installer file with `FABRIC_INSTALLER`, such as:
-
-```
-docker run -d -v /path/on/host:/data ... \
-    -e FABRIC_INSTALLER=fabric-installer-0.5.0.32.jar ...
-```
-
-To download a Fabric installer from a custom location, such as your own file repository, specify the URL with `FABRIC_INSTALLER_URL`, such as:
-
-```
-docker run -d -v /path/on/host:/data ... \
-    -e FABRIC_INSTALLER_URL=http://HOST/fabric-installer-0.5.0.32.jar ...
-```
-
-A specific loader version can be requested using `FABRIC_LOADER_VERSION`, such as:
-
-```
-docker run -d -v /path/on/host:/data ... \
-    -e FABRIC_LOADER_VERSION=0.11.7
-```
-
 ### Running a Limbo server
 
 A [Limbo](https://github.com/LOOHP/Limbo) server can be run by setting `TYPE` to `LIMBO`.
@@ -662,6 +652,20 @@ then you apply a workaround by adding this to the run invocation:
 
     -e FTB_LEGACYJAVAFIXER=true
 
+## Running a server with a packwiz modpack
+
+[packwiz](https://packwiz.infra.link/) is a CLI tool for maintaining and providing modpack definitions, with support for both CurseForge and Modrinth as sources. See the [packwiz tutorial](https://packwiz.infra.link/tutorials/getting-started/) for more information.
+
+To configure server mods using a packwiz modpack, set the `PACKWIZ_URL` environment variable to the location of your `pack.toml` modpack definition:
+
+    docker run -d -v /path/on/host:/data -e TYPE=FABRIC \
+        -e "PACKWIZ_URL=https://example.com/modpack/pack.toml" \
+        itzg/minecraft-server
+
+packwiz modpack defitions are processed before other mod definitions (`MODPACK`, `MODS`, etc.) to allow for additional processing/overrides you may want to perform (in case of mods not available via Modrinth/CurseForge, or you do not maintain the pack).
+
+> packwiz is pre-configured to only download server mods. If client-side mods are downloaded and cause issues, check your pack.toml configuration, and make sure any client-only mods are not set to `"both"`, but rather `"client"` for the side configuration item.
+
 ## Working with mods and plugins
 
 ### Optional plugins, mods, and config attach points
@@ -672,7 +676,7 @@ There are optional volume paths that can be attached to supply content to be cop
 : contents are synchronized into `/data/plugins` for Bukkit related server types. Set `SYNC_SKIP_NEWER_IN_DESTINATION=false` if you want files from `/plugins` to take precedence over newer files in `/data/plugins`.
 
 `/mods`
-: contents are synchronized into `/data/mods` for Forge related server types. The destination can be changed by setting `COPY_MODS_DEST`.
+: contents are synchronized into `/data/mods` for Fabric and Forge related server types. The destination can be changed by setting `COPY_MODS_DEST`.
 
 `/config`
 : contents are synchronized into `/data/config` by default, but can be changed with `COPY_CONFIG_DEST`. For example, `-v ./config:/config -e COPY_CONFIG_DEST=/data` will allow you to copy over files like `bukkit.yml` and so on directly into the server directory. Set `SYNC_SKIP_NEWER_IN_DESTINATION=false` if you want files from `/config` to take precedence over newer files in `/data/config`.
@@ -685,7 +689,7 @@ For example: `-e REMOVE_OLD_MODS=TRUE -e REMOVE_OLD_MODS_INCLUDE="*.jar" -e REMO
 
 These paths work well if you want to have a common set of modules in a separate location, but still have multiple worlds with different server requirements in either persistent volumes or a downloadable archive.
 
-> For more flexibility with mods/plugins preparation, you can declare directories to use in [the `MODS` variable](#downloadable-modplugin-pack-for-forge-bukkit-and-spigot-servers)
+> For more flexibility with mods/plugins preparation, you can declare directories to use in [the `MODS` variable](#downloadable-modplugin-pack-for-forge-fabric-and-bukkit-like-servers)
 
 ### Auto-downloading SpigotMC/Bukkit/PaperMC plugins
 
@@ -702,10 +706,10 @@ For example, the following will auto-download the [EssentialsX](https://www.spig
 
     -e SPIGET_RESOURCES=9089,34315
 
-### Downloadable mod/plugin pack for Forge, Bukkit, and Spigot Servers
+### Downloadable mod/plugin pack for Forge, Fabric, and Bukkit-like Servers
 
 Like the `WORLD` option above, you can specify the URL or path of a "mod pack"
-to download and install into `mods` for Forge or `plugins` for Bukkit/Spigot.
+to download and install into `mods` for Forge/Fabric or `plugins` for Bukkit/Spigot.
 To use this option pass the environment variable `MODPACK`, such as
 
     docker run -d -e MODPACK=http://www.example.com/mods/modpack.zip ...
@@ -842,24 +846,35 @@ values.
 
 > **NOTE** it is very important to set this with servers exposed to the internet where you want only limited players to join.
 
-To whitelist players for your Minecraft server, pass the Minecraft usernames separated by commas via the `WHITELIST` environment variable, such as
+To whitelist players for your Minecraft server, you can:
+- Provide the url or path to a whitelist file via `WHITELIST_FILE` environment variable  
+    `docker run -d -e WHITELIST_FILE=/extra/whitelist.json ...`
+- Provide a list of usernames and/or UUIDs separated by commas via the `WHITELIST` environment variable  
+    `docker run -d -e WHITELIST=user1,uuid2 ...`
 
-    docker run -d -e WHITELIST=user1,user2 ...
+To enforce the whitelist and auto-kick players not included in whitelist configuration, set `ENFORCE_WHITELIST=TRUE`. **By default** any user can join your Minecraft server if it's publicly accessible, regardless of your whitelist configuration.
 
-If the `WHITELIST` environment variable is not used, any user can join your Minecraft server if it's publicly accessible.
+If whitelist configuration already exists, `WHITELIST_FILE` will not be retrieved and any usernames in `WHITELIST` are **added** to the whitelist configuration. You can enforce regeneration of the whitelist on each server startup by setting `OVERRIDE_WHITELIST` to "true". This will delete the whitelist file before processing whitelist configuration.
 
-> NOTE: When `WHITELIST` is used the server properties `white-list` and `whitelist` will automatically get set to `true`.
+> NOTE: You can provide both `WHITELIST_FILE` and `WHITELIST`, which are processed in that order.
 
-> By default, the players in `WHITELIST` are **added** to the final `whitelist.json` file by the Minecraft server. If you set `OVERRIDE_WHITELIST` to "true" then the `whitelist.json` file will be recreated on each server startup.
+> NOTE: UUIDs passed via `WHITELIST` need to be the dashed variant, otherwise it not be recognised and instead added as a username.
+
+> If running Minecraft 1.7.5 or earlier, these variables will apply to `white-list.txt`, with 1.7.6 implementing support for `whitelist.json`. Make sure your `WHITELIST_FILE` is in the appropriate format.
+
+If either `WHITELIST_FILE` or `WHITELIST` is provided, the server property `white-list` is automatically set to `true`, enabline whitelist functionality. Alternatively you can set `ENABLE_WHITELIST=TRUE` to only set the server property `white-list` without modifying the whitelist file. In this case the whitelist can be managed using the `whitelist add` and `whitelist remove` commands. Remember you can set enforcement via the `ENFORCE_WHITELIST` variable.
 
-Alternatively, you can set `ENABLE_WHITELIST=true` to only set the server properties `white-list` and `whitelist` without modifying the whitelist file. In this case the whitelist is solely managed using the `whitelist add` and `whitelist remove` commands.
 ### Op/Administrator Players
 
-To add more "op" (aka adminstrator) users to your Minecraft server, pass the Minecraft usernames separated by commas via the `OPS` environment variable, such as
+Similar to the whitelist, to add users as operators (aka adminstrators) to your Minecraft server, you can:
+- Provide te url or path to an ops file via `OPS_FILE` environment variable  
+    `docker run -d -e OPS_FILE=https://config.example.com/extra/ops.json ...`
+- Provide a list of usernames and/or UUIDs separated by commas via the `OPS` environment variable  
+    `docker run -d -e OPS=user1,uuid2 ...`
 
-    docker run -d -e OPS=user1,user2 ...
+If ops configuration already exists, `OPS_FILE` will not be retrieved and any usernames in `OPS` are **added** to the ops configuration. You can enforce regeneration of the ops configuration on each server startup by setting `OVERRIDE_OPS` to "true". This will delete the ops file before processing ops configuration.
 
-> By default, the players in `OPS` are **added** to the final `ops.json` file by the Minecraft server. If you set `OVERRIDE_OPS` to "true" then the `ops.json` file will be recreated on each server startup.
+> Similar to whitelists, you can provide both `OPS_FILE` and `OPS`, and Minecraft 1.7.5 or earlier will use `ops.txt` rather than `ops.json`.
 
 ### Server icon
 
@@ -1057,9 +1072,9 @@ In Minecraft 1.13+ you need to pass json ([generator site](https://misode.github
 
 You can set a link to a custom resource pack and set it's checksum using the `RESOURCE_PACK` and `RESOURCE_PACK_SHA1` options respectively, the default is blank:
 
-    docker run -d -e 'RESOURCE_PACK=http\://link.com/to/pack.zip?\=1' -e 'RESOURCE_PACK_SHA1=d5db29cd03a2ed055086cef9c31c252b4587d6d0'
+    docker run -d -e 'RESOURCE_PACK=http://link.com/to/pack.zip?=1' -e 'RESOURCE_PACK_SHA1=d5db29cd03a2ed055086cef9c31c252b4587d6d0'
 
-**NOTE:** `:` and `=` must be escaped using `\`. The checksum plain-text hexadecimal.
+You can enforce the resource pack on clients by setting `RESOURCE_PACK_ENFORCE` to `TRUE` (default: `FALSE`).
 
 ### Level / World Save Name
 
@@ -1317,6 +1332,8 @@ If you would like to `docker attach` to the Minecraft server console with color
 > This will bypass graceful server shutdown handling when using `docker stop`, so be sure the server console's `stop` command.
 > 
 > Make to enable stdin and tty with `-it` when using `docker run` or `stdin_open: true` and `tty: true` when using docker compose.
+>
+> This feature is incompatible with Autopause and cannot be set when `ENABLE_AUTOPAUSE=true`.
 
 ### Server Shutdown Options
 
@@ -1371,7 +1388,7 @@ To enable remote JMX, such as for profiling with VisualVM or JMC, add the enviro
 
 ### Enable Aikar's Flags
 
-[Aikar has does some research](https://mcflags.emc.gs/) into finding the optimal JVM flags for GC tuning, which becomes more important as more users are connected concurrently. The set of flags documented there can be added using
+[Aikar has does some research](https://aikar.co/2018/07/02/tuning-the-jvm-g1gc-garbage-collector-flags-for-minecraft/) into finding the optimal JVM flags for GC tuning, which becomes more important as more users are connected concurrently. The set of flags documented there can be added using
 
     -e USE_AIKAR_FLAGS=true
 
@@ -1434,6 +1451,8 @@ Enable the Autopause functionality by setting:
 -e ENABLE_AUTOPAUSE=TRUE
 ```
 
+Autopause is not compatible with `EXEC_DIRECTLY=true` and the two cannot be set together.
+
 The following environment variables define the behaviour of auto-pausing:
 * `AUTOPAUSE_TIMEOUT_EST`, default `3600` (seconds)
   describes the time between the last client disconnect and the pausing of the process (read as timeout established)

bin/mc-health

@@ -2,6 +2,9 @@
 
 # shellcheck source=../scripts/start-utils
 . "${SCRIPTS:-/}start-utils"
+if [ -f /data/.mc-health.env ]; then
+  . /data/.mc-health.env
+fi
 
 if isTrue "${DISABLE_HEALTHCHECK}"; then
   echo "Healthcheck disabled"
@@ -10,6 +13,6 @@ elif isTrue "${ENABLE_AUTOPAUSE}" && [[ "$( ps -ax -o stat,comm | grep 'java' |
   echo "Java process suspended by Autopause function"
   exit 0
 else
-  mc-monitor status --host localhost --port "${SERVER_PORT:-25565}"
+  mc-monitor status "${MC_HEALTH_EXTRA_ARGS[@]}" --host localhost --port "${SERVER_PORT:-25565}"
   exit $?
 fi

docker-versions-create.sh

@@ -7,7 +7,6 @@ branches_list=(
   'java8-openj9'
   'java11'
   'java11-openj9'
-  'java16'
   'java16-openj9'
   'java17'
   )
@@ -131,3 +130,28 @@ EOL
   fi
 
 done
+
+if [[ $tag ]]; then
+  if [ -f "$HOME/.github.env" ]; then
+    source "$HOME/.github.env"
+    if [[ $GITHUB_TOKEN ]]
+    then
+      auth=(-u ":$GITHUB_TOKEN")
+      base=https://api.github.com
+      : "${owner:=itzg}"
+      : "${repo:=docker-minecraft-server}"
+      read -r -d '' releaseBody << EOF
+        {
+          "tag_name": "$tag",
+          "name": "$tag",
+          "generate_release_notes": true
+        }
+EOF
+      if ! echo curl "${auth[@]}" -H "Accept: application/vnd.github.v3+json" \
+        "${base}/repos/${owner}/${repo}/releases" -d "$releaseBody"; then
+          echo "ERROR failed to create github release $tag"
+          exit 1
+      fi
+    fi
+  fi
+fi

examples/k8s/using-statefulset.yml

@@ -3,18 +3,18 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   labels:
-    app: example
-  name: example
+    app: mc-example
+  name: mc-example
 spec:
   replicas: 1
-  serviceName: example
+  serviceName: mc-example
   selector:
     matchLabels:
-      app: example
+      app: mc-example
   template:
     metadata:
       labels:
-        app: example
+        app: mc-example
     spec:
       containers:
         - name: mc
@@ -25,6 +25,18 @@ spec:
           volumeMounts:
             - mountPath: /data
               name: data
+          readinessProbe:
+            exec:
+              command:
+                - mc-monitor 
+                - status 
+                - --host 
+                - localhost 
+                - --port
+                - "25565"
+            initialDelaySeconds: 30
+            periodSeconds: 5
+            failureThreshold: 18
   volumeClaimTemplates:
     - metadata:
         name: data
@@ -39,12 +51,12 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    service: example
-  name: example
+    service: mc-example
+  name: mc-example
 spec:
   ports:
     - port: 25565
       targetPort: 25565
   selector:
-    app: example
-  type: LoadBalancer
+    app: mc-example
+  type: NodePort

files/autopause/autopause-fcns.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 current_uptime() {
-  echo $(awk '{print $1}' /proc/uptime | cut -d . -f 1)
+  awk '{print $1}' /proc/uptime | cut -d . -f 1
 }
 
 java_running() {
@@ -17,15 +17,15 @@ rcon_client_exists() {
 }
 
 mc_server_listening() {
-  mc-monitor status --host localhost --port $SERVER_PORT --timeout 10s >& /dev/null
+  mc-monitor status --host localhost --port "$SERVER_PORT" --timeout 10s >& /dev/null
 }
 
 java_clients_connected() {
   local connections
   if java_running ; then
-    connections=$(mc-monitor status --host localhost --port $SERVER_PORT --show-player-count)
+    connections=$(mc-monitor status --host localhost --port "$SERVER_PORT" --show-player-count)
   else
     connections=0
   fi
-  (( $connections > 0 ))
+  (( connections > 0 ))
 }

scripts/start-configuration

@@ -32,6 +32,10 @@ if [ ! -e /data/eula.txt ]; then
   writeEula
 fi
 
+if isTrue "${ENABLE_AUTOPAUSE}" && isTrue "${EXEC_DIRECTLY:-false}"; then
+    log "EXEC_DIRECTLY=true is incompatible with ENABLE_AUTOPAUSE=true"
+    exit 1
+fi
 
 if [[ $PROXY ]]; then
     export http_proxy="$PROXY"
@@ -92,6 +96,14 @@ if isTrue "${ENABLE_AUTOPAUSE}"; then
   ${SCRIPTS:-/}start-autopause
 fi
 
+if versionLessThan 1.7; then
+  echo "
+MC_HEALTH_EXTRA_ARGS=(
+  --use-server-list-ping
+)
+  " > /data/.mc-health.env
+fi
+
 log "Resolving type given ${TYPE}"
 case "${TYPE^^}" in
   *BUKKIT|SPIGOT)

scripts/start-deployAirplane

@@ -1,10 +1,11 @@
 #!/bin/bash
-set -euo pipefail
-IFS=$'\n\t'
 
 . ${SCRIPTS:-/}start-utils
+set -euo pipefail
 isDebugging && set -x
 
+IFS=$'\n\t'
+
 if [ "${VERSION}" != "LATEST" ] && [ "${VERSION}" != "1.16" ] && [ "${VERSION}" != "1.17" ] && [ "${VERSION}" != "PURPUR" ] && [ "${VERSION}" != "PURPUR-1.16" ] ; then
   log "ERROR: Airplane server type only supports VERSION=LATEST, VERSION=1.17, VERSION=1.16, VERSION=PURPUR or VERSION=PURPUR-1.16. Note that these are branches, not #.#.# versions."
   exit 1
@@ -35,6 +36,12 @@ log "Using Airplane-${AIRPLANE_BRANCH} branch"
 
 export SERVER=airplane-${AIRPLANE_BRANCH}-${AIRPLANE_BUILD}.jar
 
+log "Removing old Airplane versions ..."
+shopt -s nullglob
+for f in airplane-*.jar; do
+  [[ $f != $SERVER ]] && rm $f
+done
+
 if [ ! -f "$SERVER" ] || isTrue "${FORCE_REDOWNLOAD:-false}"; then
     downloadUrl="https://ci.tivy.ca/job/Airplane-${AIRPLANE_BRANCH}/${AIRPLANE_BUILD}/artifact/launcher-${AIRPLANE_TYPE}.jar"
     log "Downloading Airplane from $downloadUrl ..."
@@ -47,6 +54,7 @@ fi
 
 # Normalize on Spigot for later operations
 export TYPE=SPIGOT
+export FAMILY=SPIGOT
 export SKIP_LOG4J_CONFIG=true
 
 exec ${SCRIPTS:-/}start-spiget "$@"

scripts/start-deployBukkitSpigot

@@ -64,7 +64,7 @@ function downloadSpigot {
   fi
 
   if [[ -z $downloadUrl ]]; then
-    if versionLessThan 1.16.5; then
+    if versionLessThan 1.16.5 || ([[ ${getbukkitFlavor} = "craftbukkit" ]] && [[ ${VANILLA_VERSION} = "1.16.5" ]]); then
       downloadUrl="https://cdn.getbukkit.org/${getbukkitFlavor}/${getbukkitFlavor}-${VANILLA_VERSION}.jar"
     else
       downloadUrl="https://download.getbukkit.org/${getbukkitFlavor}/${getbukkitFlavor}-${VANILLA_VERSION}.jar"
@@ -127,6 +127,7 @@ fi
 
 # Normalize on Spigot for operations below
 export TYPE=SPIGOT
+export FAMILY=SPIGOT
 export SKIP_LOG4J_CONFIG=true
 
 exec ${SCRIPTS:-/}start-spiget "$@"

scripts/start-deployCF

@@ -233,4 +233,5 @@ elif [ -e "${FTB_DIR}/Install.sh" ]; then
   popd
 fi
 
+export FAMILY=FORGE
 exec "${SCRIPTS:-/}start-setupWorld" "$@"

scripts/start-deployCanyon

@@ -2,16 +2,11 @@
 set -euo pipefail
 IFS=$'\n\t'
 
-. ${SCRIPTS:-/}start-utils
+# shellcheck source=start-utils
+. "${SCRIPTS:-/}start-utils"
 isDebugging && set -x
 
-: ${CANYON_BUILD:=lastSuccessfulBuild}
-JAVA_VER=$(java -version 2>&1 | head -1 | cut -d'"' -f2 | sed '/^1\./s///' | cut -d'.' -f1)
-
-if [ "${JAVA_VER}" != "8" ]; then
-  log "ERROR: Canyon server type only supports Java version 8"
-  exit 1
-fi
+: "${CANYON_BUILD:=lastSuccessfulBuild}"
 
 if [ "${VERSION}" != "b1.7.3" ]; then
   log "ERROR: Canyon server type only supports VERSION=b1.7.3"
@@ -49,6 +44,7 @@ fi
 
 # Normalize on Spigot for later operations
 export TYPE=SPIGOT
+export FAMILY=SPIGOT
 export SKIP_LOG4J_CONFIG=true
 
 exec ${SCRIPTS:-/}start-spiget "$@"

scripts/start-deployCatserver

@@ -28,5 +28,6 @@ fi
 
 export SKIP_LOG4J_CONFIG=true
 
+export FAMILY=HYBRID
 # Continue to Final Setup
 exec ${SCRIPTS:-/}start-setupWorld "$@"

scripts/start-deployCrucible

@@ -56,5 +56,6 @@ fi
 
 export SERVER
 export SKIP_LOG4J_CONFIG=true
+export FAMILY=HYBRID
 
 exec "${SCRIPTS:-$(dirname "$0")}/start-setupWorld" "$@"

scripts/start-deployCustom

@@ -31,5 +31,5 @@ else
 fi
 
 export SKIP_LOG4J_CONFIG=true
-
+export FAMILY=HYBRID
 exec ${SCRIPTS:-/}start-setupWorld $@

scripts/start-deployFTBA

@@ -67,7 +67,7 @@ variants=(
   forge-${mcVersion}-${forgeVersion}-${mcVersion}-universal.jar
   fabric-${mcVersion}-${fabricVersion}-server-launch.jar
 )
-for f in ${variants[@]}; do
+for f in "${variants[@]}"; do
   if [ -f $f ]; then
     export SERVER=$f
     break
@@ -79,4 +79,5 @@ if ! [ -v SERVER ]; then
   exit 2
 fi
 
+export FAMILY=FORGE
 exec ${SCRIPTS:-/}start-setupWorld $@

scripts/start-deployFabric

@@ -69,4 +69,5 @@ if [[ ! -e ${SERVER} ]]; then
   mv fabric-server-launch.jar "${SERVER}"
 fi
 
+export FAMILY=FABRIC
 exec ${SCRIPTS:-/}start-setupWorld "$@"

scripts/start-deployForge

@@ -11,8 +11,8 @@ get_installer() {
     log "Downloading $normForgeVersion"
 
     forgeFileNames="
-    $normForgeVersion/forge-$normForgeVersion-installer.jar
     $shortForgeVersion/forge-$shortForgeVersion-installer.jar
+    $normForgeVersion/forge-$normForgeVersion-installer.jar
   "
 
     for fn in $forgeFileNames; do
@@ -102,7 +102,7 @@ resolve_versions() {
         ;;
 
       RECOMMENDED)
-        if ! FORGE_VERSION=$(get --json-path ".promos['$VANILLA_VERSION-recommended']" "$promosUrl"); then
+        if ! FORGE_VERSION=$(get -s --json-path ".promos['$VANILLA_VERSION-recommended']" "$promosUrl"); then
           if ! FORGE_VERSION=$(get --json-path ".promos['$VANILLA_VERSION-latest']" "$promosUrl"); then
             log "ERROR: Version $VANILLA_VERSION is not supported by Forge"
             log "       Refer to http://files.minecraftforge.net/ for supported versions"
@@ -147,4 +147,5 @@ else
   fi
 fi
 
+export FAMILY=FORGE
 exec "${SCRIPTS:-/}start-setupWorld" "$@"

scripts/start-deployLimbo

@@ -60,4 +60,5 @@ export LEVEL
 
 export SKIP_LOG4J_CONFIG=true
 
+export FAMILY=LIMBO
 exec ${SCRIPTS:-/}start-setupWorld $@

scripts/start-deployMagma

@@ -89,4 +89,5 @@ else
   fi
 fi
 
-exec ${SCRIPTS:-/}start-setupWorld $@
+export FAMILY=HYBRID
+exec ${SCRIPTS:-/}start-setupWorld "$@"

scripts/start-deployMohist

@@ -40,4 +40,5 @@ fi
 
 export SKIP_LOG4J_CONFIG=true
 
+export FAMILY=HYBRID
 exec "${SCRIPTS:-$(dirname "$0")}/start-setupWorld" "$@"

scripts/start-deployPaper

@@ -74,6 +74,7 @@ fi
 
 # Normalize on Spigot for downstream operations
 export TYPE=SPIGOT
+export FAMILY=SPIGOT
 export SKIP_LOG4J_CONFIG=true
 
 exec ${SCRIPTS:-/}start-spiget "$@"

scripts/start-deployPurpur

@@ -10,7 +10,7 @@ isDebugging && set -x
 : ${FORCE_REDOWNLOAD:=false}
 
 if [[ ${PURPUR_BUILD} == LATEST ]]; then
-  PURPUR_BUILD=$(curl -fsSL "https://api.pl3x.net/v2/purpur/${VANILLA_VERSION}" |
+  PURPUR_BUILD=$(curl -fsSL "https://api.purpurmc.org/v2/purpur/${VANILLA_VERSION}" |
     jq -r '.builds.latest' || echo "")
   if [[ -z ${PURPUR_BUILD} ]]; then
     log "ERROR: Failed to locate a Purpur build for ${VANILLA_VERSION}."
@@ -22,7 +22,7 @@ fi
 export SERVER="purpur-${VANILLA_VERSION}-${PURPUR_BUILD}.jar"
 
 if [ ! -f "$SERVER" ] || isTrue "$FORCE_REDOWNLOAD"; then
-    downloadUrl="https://api.pl3x.net/v2/purpur/${VANILLA_VERSION}/${PURPUR_BUILD}/download"
+    downloadUrl="https://api.purpurmc.org/v2/purpur/${VANILLA_VERSION}/${PURPUR_BUILD}/download"
     log "Downloading Purpur from $downloadUrl ..."
     if ! curl -fsSL -o "$SERVER" "$downloadUrl"; then
       log "ERROR: failed to download from $downloadUrl (status=$?)"
@@ -32,6 +32,7 @@ fi
 
 # Normalize on Spigot for later operations
 export TYPE=SPIGOT
+export FAMILY=SPIGOT
 export SKIP_LOG4J_CONFIG=true
 
 exec ${SCRIPTS:-/}start-spiget "$@"

scripts/start-deploySpongeVanilla

@@ -37,4 +37,5 @@ if [ ! -e $SERVER ] || [ -n "$FORCE_REDOWNLOAD" ]; then
   curl -sSL -o $SERVER https://repo.spongepowered.org/maven/org/spongepowered/$TYPE/$SPONGEVERSION/$SERVER
 fi
 
-exec ${SCRIPTS:-/}start-setupWorld $@
+export FAMILY=SPONGE
+exec ${SCRIPTS:-/}start-setupWorld "$@"

scripts/start-deployVanilla

@@ -52,5 +52,5 @@ elif [[ -L /data/minecraft_server.jar ]]; then
 fi
 
 isDebugging && ls -l
-
+export FAMILY=VANILLA
 exec "${SCRIPTS:-/}start-setupWorld" "$@"

scripts/start-finalExec

@@ -3,24 +3,93 @@
 . ${SCRIPTS:-/}start-utils
 isDebugging && set -x
 
-if [ -n "$OPS" ]; then
-  log "Updating ops"
-  rm -f /data/ops.txt.converted
-  echo $OPS | awk -v RS=, '{print}' > /data/ops.txt
-fi
-if isTrue "${OVERRIDE_OPS}"; then
-  log "Recreating ops.json file at server startup"
-  rm -f /data/ops.json
+if versionLessThan 1.7.6; then
+  opsFile=ops.txt
+  whitelistFile=white-list.txt
+else
+  opsFile=ops.json
+  whitelistFile=whitelist.json
 fi
 
-if [ -n "$WHITELIST" ]; then
-  log "Updating whitelist"
-  rm -f /data/white-list.txt.converted
-  echo $WHITELIST | awk -v RS=, '{print}' > /data/white-list.txt
+function process_user_file() {
+  local output=$1
+  local source=$2
+
+  if isURL "$source"; then
+    log "Downloading $output from $source"
+    if ! get -o /data/$output "$source"; then
+      log "ERROR: failed to download from $source"
+      exit 2
+    fi
+  else
+    log "Copying $output from $source"
+    if ! cp "$source" /data/$output; then
+      log "ERROR: failed to copy from $source"
+      exit 1
+    fi
+  fi
+}
+
+function process_user_csv() {
+  local output=$1
+  local list=$2
+  local playerDataList
+
+  if [[ "$output" == *"ops"* ]]; then
+    # Extra data for ops.json
+    userData='{"uuid": .id, "name": .username, "level": 4}'
+  else
+    userData='{"uuid": .id, "name": .username}'
+  fi
+
+  log "Updating ${output%.*}"
+  for i in ${list//,/ }
+  do
+    if [ -e "$output" ] && grep -q "$i" "$output"; then
+      log "$i already present in $output, skipping"
+      continue
+    fi
+    if ! playerData=$(get "https://playerdb.co/api/player/minecraft/$i" | jq -re ".data.player"); then
+      log "WARNING: Could not lookup user $i for ${output} addition"
+    else
+      playerDataList=$playerDataList$(echo $playerData | jq -r "$userData")
+    fi
+  done
+  local newUsers=$(echo $playerDataList | jq -s .)
+  if [[ $output =~ .*\.txt ]]; then
+    # username list for txt config (Minecraft <= 1.7.5)
+    echo $newUsers | jq -r '.[].name' >> /data/${output}
+    sort -u /data/${output} -o /data/${output}
+  elif [ -e /data/${output} ]; then
+    # Merge with existing json file
+    local currentUsers=$(cat /data/${output})
+    jq --argjson current "$currentUsers" --argjson new "$newUsers" -n '$new + $current | unique_by(.uuid)' > /data/${output}
+  else
+    # New json file
+    echo $newUsers > /data/${output}
+  fi
+}
+
+if isTrue "${OVERRIDE_OPS}"; then
+  log "Recreating ${opsFile} file at server startup"
+  rm -f /data/${opsFile}
 fi
+if [ -n "${OPS_FILE}" ] && [ ! -e "/data/${opsFile}" ]; then
+  process_user_file ${opsFile} "$OPS_FILE"
+fi
+if [ -n "${OPS}" ]; then
+  process_user_csv ${opsFile} "$OPS"
+fi
+
 if isTrue "${OVERRIDE_WHITELIST}"; then
-  log "Recreating whitelist.json file at server startup"
-  rm -f /data/whitelist.json
+  log "Recreating ${whitelistFile} file at server startup"
+  rm -f /data/${whitelistFile}
+fi
+if [ -n "${WHITELIST_FILE}" ] && [ ! -e "/data/${whitelistFile}" ]; then
+  process_user_file ${whitelistFile} "$WHITELIST_FILE"
+fi
+if [ -n "${WHITELIST}" ]; then
+  process_user_csv ${whitelistFile} "$WHITELIST"
 fi
 
 if [ -n "$ICON" ]; then
@@ -81,6 +150,28 @@ if [ -n "$JVM_DD_OPTS" ]; then
       done
 fi
 
+patchLog4jConfig() {
+  file=${1?}
+  url=${2?}
+  if ! get -o "$file" "$url"; then
+    log "ERROR: failed to download corrected log4j config"
+    exit 1
+  fi
+  JVM_OPTS="-Dlog4j.configurationFile=${file} ${JVM_OPTS}"
+}
+
+# Patch Log4j remote code execution vulnerability
+# See https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition
+if versionLessThan 1.7; then
+  : # No patch required here.
+elif isFamily VANILLA && versionLessThan 1.12; then
+  patchLog4jConfig log4j2_17-111.xml https://launcher.mojang.com/v1/objects/dd2b723346a8dcd48e7f4d245f6bf09e98db9696/log4j2_17-111.xml
+elif isFamily VANILLA && versionLessThan 1.17; then
+  patchLog4jConfig log4j2_112-116.xml https://launcher.mojang.com/v1/objects/02937d122c86ce73319ef9975b58896fc1b491d1/log4j2_112-116.xml
+elif versionLessThan 1.18.1; then
+  JVM_OPTS="-Dlog4j2.formatMsgNoLookups=true ${JVM_OPTS}"
+fi
+
 if isTrue ${ENABLE_JMX}; then
   : ${JMX_PORT:=7091}
   JVM_OPTS="${JVM_OPTS}

scripts/start-setupEnvVariables

@@ -1,17 +1,18 @@
 #!/bin/bash
 
-. ${SCRIPTS:-/}start-utils
+# shellcheck source=start-utils
+. "${SCRIPTS:-/}start-utils"
 
 set -e
 
-: ${REPLACE_ENV_IN_PLACE:=${REPLACE_ENV_VARIABLES:-false}}
-: ${REPLACE_ENV_PATHS:=/data}
-: ${REPLACE_ENV_SUFFIXES:=yml,yaml,txt,cfg,conf,properties,hjson,json,tml,toml}
-: ${REPLACE_ENV_VARIABLE_PREFIX:=${ENV_VARIABLE_PREFIX:-CFG_}}
-: ${REPLACE_ENV_VARIABLES_EXCLUDES:=}
-: ${REPLACE_ENV_VARIABLES_EXCLUDE_PATHS:=}
-: ${PATCH_DEFINITIONS:=}
-: ${DEBUG:=false}
+: "${REPLACE_ENV_IN_PLACE:=${REPLACE_ENV_VARIABLES:-false}}"
+: "${REPLACE_ENV_PATHS:=/data}"
+: "${REPLACE_ENV_SUFFIXES:=yml,yaml,txt,cfg,conf,properties,hjson,json,tml,toml}"
+: "${REPLACE_ENV_VARIABLE_PREFIX:=${ENV_VARIABLE_PREFIX:-CFG_}}"
+: "${REPLACE_ENV_VARIABLES_EXCLUDES:=}"
+: "${REPLACE_ENV_VARIABLES_EXCLUDE_PATHS:=}"
+: "${PATCH_DEFINITIONS:=}"
+: "${DEBUG:=false}"
 
 if isTrue "${REPLACE_ENV_IN_PLACE}"; then
   log "Replacing env variables in ${REPLACE_ENV_PATHS} that match the prefix $REPLACE_ENV_VARIABLE_PREFIX ..."
@@ -20,15 +21,15 @@ if isTrue "${REPLACE_ENV_IN_PLACE}"; then
     --replace-env-file-suffixes="${REPLACE_ENV_SUFFIXES}" \
     --replace-env-excludes="${REPLACE_ENV_VARIABLES_EXCLUDES}" \
     --replace-env-exclude-paths="${REPLACE_ENV_VARIABLES_EXCLUDE_PATHS}" \
-    --replace-env-prefix=${REPLACE_ENV_VARIABLE_PREFIX} \
+    --replace-env-prefix="${REPLACE_ENV_VARIABLE_PREFIX}" \
     "${REPLACE_ENV_PATHS[@]}"
 fi
 
 if [[ ${PATCH_DEFINITIONS} ]]; then
   log "Applying patch definitions from ${PATCH_DEFINITIONS}"
   mc-image-helper --debug=${DEBUG} patch \
-    --patch-env-prefix=${REPLACE_ENV_VARIABLE_PREFIX} \
+    --patch-env-prefix="${REPLACE_ENV_VARIABLE_PREFIX}" \
     "${PATCH_DEFINITIONS}"
 fi
 
-exec ${SCRIPTS:-/}start-finalExec $@
+exec "${SCRIPTS:-/}start-finalExec" "$@"

scripts/start-setupModpack

@@ -20,6 +20,33 @@ if isTrue "${REMOVE_OLD_MODS}" && [ -z "${MODS_FILE}" ]; then
   removeOldMods /data/plugins
 fi
 
+# If packwiz url passed, bootstrap packwiz and update mods before other modpack processing
+if [[ "${PACKWIZ_URL}" ]]; then
+  # Ensure we have the latest packwiz bootstrap installer
+  latestPackwiz=$(curl -fsSL https://api.github.com/repos/comp500/packwiz-installer-bootstrap/releases/latest)
+  if [[ -z "${latestPackwiz}" ]]; then
+    log "WARNING: Could not retrieve Packwiz bootstrap installer release information"
+  else
+    isDebugging && log "Latest packwiz ${latestPackWiz}"
+    latestPackwizVer=$(echo ${latestPackwiz} | jq --raw-output '.tag_name')
+    latestPackwizUrl=$(echo ${latestPackwiz} | jq --raw-output '.assets[] | select(.name | match("packwiz-installer-bootstrap.jar")) | .url')
+    : "${PACKWIZ_JAR:=packwiz-installer-bootstrap_${latestPackwizVer}.jar}"
+    if [[ ! -e $PACKWIZ_JAR ]]; then
+      log "Downloading Packwiz ${latestPackwizVer}"
+      curl -H "Accept:application/octet-stream" -o "$PACKWIZ_JAR" -fsSL ${latestPackwizUrl}
+      ln -sf "${PACKWIZ_JAR}" packwiz-installer-bootstrap.jar
+    fi
+  fi
+  if [[ ! -e packwiz-installer-bootstrap.jar ]]; then
+    log "ERROR: Packwiz not available or could not be downloaded from Github!"
+    exit 1
+  fi
+  if isURL "${PACKWIZ_URL}"; then
+    log "Running packwiz against URL: ${PACKWIZ_URL}"
+    java -jar packwiz-installer-bootstrap.jar -g -s server "${PACKWIZ_URL}"
+  fi
+fi
+
 # If supplied with a URL for a modpack (simple zip of jars), download it and unpack
 if [[ "$MODPACK" ]]; then
   if isURL "${MODPACK}"; then

scripts/start-setupServerProperties

@@ -33,15 +33,18 @@ function setServerProp {
 }
 
 function customizeServerProps {
-  if [ -n "$WHITELIST" ] || isTrue "${ENABLE_WHITELIST:-false}"; then
-    log "Creating whitelist"
-    setServerPropValue "whitelist" "true"
+  # Whitelist processing
+  if [ -n "$WHITELIST" ] || [ -n "$WHITELIST_FILE" ] || isTrue "${ENABLE_WHITELIST:-false}"; then
+    log "Enabling whitelist functionality"
     setServerPropValue "white-list" "true"
   else
-    log "Disabling whitelist"
-    setServerPropValue "whitelist" "false"
+    log "Disabling whitelist functionality"
     setServerPropValue "white-list" "false"
   fi
+  setServerProp "enforce-whitelist" ENFORCE_WHITELIST
+  if [[ $(grep "enforce-whitelist" $SERVER_PROPERTIES) != *true ]]; then
+    log "WARNING: whitelist enabled but not enforced. Set ENFORCE_WHITELIST=TRUE or update 'enforce-whitelist' in server.properties to enforce the whitelist."
+  fi
 
   # If not provided, generate a reasonable default message-of-the-day,
   # which shows up in the server listing in the client
@@ -91,6 +94,7 @@ function customizeServerProps {
   setServerProp "allow-flight" ALLOW_FLIGHT
   setServerProp "resource-pack" RESOURCE_PACK
   setServerProp "resource-pack-sha1" RESOURCE_PACK_SHA1
+  setServerProp "require-resource-pack" RESOURCE_PACK_ENFORCE
   setServerProp "player-idle-timeout" PLAYER_IDLE_TIMEOUT
   setServerProp "broadcast-console-to-ops" BROADCAST_CONSOLE_TO_OPS
   setServerProp "broadcast-rcon-to-ops" BROADCAST_RCON_TO_OPS
@@ -103,7 +107,6 @@ function customizeServerProps {
   setServerProp "op-permission-level" OP_PERMISSION_LEVEL
   setServerProp "prevent-proxy-connections" PREVENT_PROXY_CONNECTIONS
   setServerProp "use-native-transport" USE_NATIVE_TRANSPORT
-  setServerProp "enforce-whitelist" ENFORCE_WHITELIST
   setServerProp "simulation-distance" SIMULATION_DISTANCE
   setServerPropValue "motd" "$(echo "$MOTD" | mc-image-helper asciify)"
   [[ $LEVEL_TYPE ]] && setServerPropValue "level-type" "${LEVEL_TYPE^^}"

scripts/start-utils

@@ -112,32 +112,7 @@ function normalizeMemSize() {
 }
 
 function versionLessThan() {
-  local activeParts
-  IFS=. read -ra activeParts <<<"${VANILLA_VERSION}"
-
-  local givenParts
-  IFS=. read -ra givenParts <<<"$1"
-
-  if ((${#activeParts[@]} < 2)); then
-    return 1
-  fi
-
-  if ((${#activeParts[@]} == 2)); then
-    if ((activeParts[0] < givenParts[0])) ||
-      ((activeParts[0] == givenParts[0] && activeParts[1] < givenParts[1])); then
-      return 0
-    else
-      return 1
-    fi
-  else
-    if ((activeParts[0] < givenParts[0])) ||
-      ((activeParts[0] == givenParts[0] && activeParts[1] < givenParts[1])) ||
-      ((activeParts[0] == givenParts[0] && activeParts[1] == givenParts[1] && activeParts[2] < givenParts[2])); then
-      return 0
-    else
-      return 1
-    fi
-  fi
+  mc-image-helper compare-versions "${VANILLA_VERSION}" lt "${1?}"
 }
 
 requireVar() {
@@ -161,7 +136,7 @@ requireEnum() {
     fi
   done
 
-  log "ERROR: $var must be set to one of $@"
+  log "ERROR: $var must be set to one of $*"
 #  exit 1
 }
 
@@ -187,4 +162,13 @@ function get() {
     flags+=("--debug")
   fi
   mc-image-helper "${flags[@]}" get "$@"
+}
+
+function isFamily() {
+  for f in "${@}"; do
+    if [[ $FAMILY == "$f" ]]; then
+      return 0
+    fi
+  done
+  return 1
 }

tests/docker-compose.test.yml

@@ -1,20 +0,0 @@
-version: "3.8"
-
-services:
-  sut:
-    depends_on:
-      - mc
-    image: itzg/mc-monitor:0.6.0
-    command: status --host mc --retry-interval 1s --retry-limit 120
-  mc:
-    restart: "no"
-    build:
-      context: ..
-      args:
-        TARGETOS: linux
-        TARGETARCH: amd64
-      cache_from:
-      - itzg/minecraft-server:latest
-    environment:
-      EULA: "TRUE"
-

tests/docker-compose.yml

@@ -0,0 +1,15 @@
+version: "3.8"
+
+services:
+  monitor:
+    depends_on:
+      - mc
+    image: itzg/mc-monitor:${MC_MONITOR_VERSION:-0.10.4}
+    command: status --host mc --retry-interval 1s --timeout 1s --retry-limit 240
+  mc:
+    restart: "no"
+    image: ${IMAGE_TO_TEST:-itzg/minecraft-server}
+    environment:
+      EULA: "TRUE"
+      VERSION: ${MINECRAFT_VERSION:-LATEST}
+

tests/test.sh

@@ -1,17 +1,22 @@
 #!/bin/bash
 
-cd $(dirname $0)
+cd "$(dirname "$0")" || exit 1
 
 failed=false
-args="-f docker-compose.test.yml"
-docker-compose $args run sut || failed=true
+
+down() {
+  docker-compose down -v
+}
+
+docker-compose run monitor || failed=true
 echo "
 Result: failed=$failed"
 
-$failed && docker-compose $args logs mc
-docker-compose $args down -v
-
 if $failed; then
+  docker-compose logs mc
+  down
   exit 1
+else
+  down
 fi