Clarify in docs to not port forward RCON unless secure (#2004)

This reverts commit 3624dc02a3.

Dockerfile

@@ -14,7 +14,7 @@ RUN --mount=target=/build,source=build \
 
 COPY --chmod=644 files/sudoers* /etc/sudoers.d
 
-EXPOSE 25565 25575
+EXPOSE 25565
 
 # hook into docker BuildKit --platform support
 # see https://docs.docker.com/engine/reference/builder/#automatic-platform-args-in-the-global-scope
@@ -46,7 +46,7 @@ RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --var version=0.1.1 --var app=maven-metadata-release --file {{.app}} \
   --from https://github.com/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
-ARG MC_HELPER_VERSION=1.24.23
+ARG MC_HELPER_VERSION=1.25.11
 ARG MC_HELPER_BASE_URL=https://github.com/itzg/mc-image-helper/releases/download/${MC_HELPER_VERSION}
 RUN curl -fsSL ${MC_HELPER_BASE_URL}/mc-image-helper-${MC_HELPER_VERSION}.tgz \
   | tar -C /usr/share -zxf - \

README.md

@@ -5,6 +5,8 @@
 [![Build and Publish](https://github.com/itzg/docker-minecraft-server/workflows/Build%20and%20Publish/badge.svg)](https://github.com/itzg/docker-minecraft-server/actions)
 [![](https://img.shields.io/badge/Donate-Buy%20me%20a%20coffee-orange.svg)](https://www.buymeacoffee.com/itzg)
 
+## Intro
+
 This docker image provides a Minecraft Server that will automatically download the latest stable
 version at startup. You can also run/upgrade to any specific version or the
 latest snapshot. See the _Versions_ section below for more information.
@@ -19,12 +21,10 @@ where, in this case, the standard server port 25565, will be exposed on your hos
 
 > Be sure to always include `-e EULA=TRUE` in your commands and container definitions, as Mojang/Microsoft requires EULA acceptance.
 
+> **DO NOT** port forward RCON on 25575 without first setting `RCON_PASSWORD` to a secure value. It is highly recommended to only use RCON within the container, such as with `rcon-cli`. 
+
 By default, the container will download the latest version of the "vanilla" [Minecraft: Java Edition server](https://www.minecraft.net/en-us/download/server) provided by Mojang. The [`VERSION`](#versions) and the [`TYPE`](#server-types) can be configured to create many variations of desired Minecraft server. 
 
-## Mitigated Log4jShell Vulnerability
-
-**Please ensure you have pulled the latest image** since [all official mitigations](https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition) are automatically applied by the container startup process.
-
 ## Looking for a Bedrock Dedicated Server
 
 For Minecraft clients running on consoles, mobile, or native Windows, you'll need to
@@ -747,13 +747,13 @@ packwiz modpack defitions are processed before other mod definitions (`MODPACK`,
 There are optional volume paths that can be attached to supply content to be copied into the data area:
 
 `/plugins`
-: contents are synchronized into `/data/plugins` for Bukkit related server types. Set `SYNC_SKIP_NEWER_IN_DESTINATION=false` if you want files from `/plugins` to take precedence over newer files in `/data/plugins`.
+: contents are synchronized into `/data/plugins` for Bukkit related server types. The source can be changed by setting `COPY_PLUGINS_SRC`. The destination can be changed by setting `COPY_PLUGINS_DEST`. Set `SYNC_SKIP_NEWER_IN_DESTINATION=false` if you want files from `/plugins` to take precedence over newer files in `/data/plugins`.
 
 `/mods`
-: contents are synchronized into `/data/mods` for Fabric and Forge related server types. The destination can be changed by setting `COPY_MODS_DEST`.
+: contents are synchronized into `/data/mods` for Fabric and Forge related server types. The source can be changed by setting `COPY_MODS_SRC`. The destination can be changed by setting `COPY_MODS_DEST`.
 
 `/config`
-: contents are synchronized into `/data/config` by default, but can be changed with `COPY_CONFIG_DEST`. For example, `-v ./config:/config -e COPY_CONFIG_DEST=/data` will allow you to copy over files like `bukkit.yml` and so on directly into the server directory. Set `SYNC_SKIP_NEWER_IN_DESTINATION=false` if you want files from `/config` to take precedence over newer files in `/data/config`.
+: contents are synchronized into `/data/config` by default, but can be changed with `COPY_CONFIG_DEST`. The source can be changed by setting `COPY_CONFIG_SRC`. For example, `-v ./config:/config -e COPY_CONFIG_DEST=/data` will allow you to copy over files like `bukkit.yml` and so on directly into the server directory. Set `SYNC_SKIP_NEWER_IN_DESTINATION=false` if you want files from `/config` to take precedence over newer files in `/data/config`.
 
 By default, the [environment variable processing](#replacing-variables-inside-configs) is performed on synchronized files that match the expected suffixes in `REPLACE_ENV_SUFFIXES` (by default "yml,yaml,txt,cfg,conf,properties,hjson,json,tml,toml") and are not excluded by `REPLACE_ENV_VARIABLES_EXCLUDES` and `REPLACE_ENV_VARIABLES_EXCLUDE_PATHS`. This processing can be disabled by setting `REPLACE_ENV_DURING_SYNC` to `false`.
 
@@ -1902,6 +1902,10 @@ To run this image on a RaspberryPi 3 B+, 4, or newer, use any of the image tags
 
 > If experiencing issues such as "sleep: cannot read realtime clock: Operation not permitted", ensure `libseccomp` is up to date on your host. In some cases adding `:Z` flag to the `/data` mount may be needed, [but use cautiously](https://docs.docker.com/storage/bind-mounts/#configure-the-selinux-label).
 
+## Mitigated Log4jShell Vulnerability
+
+**Please ensure you have pulled the latest image** since [all official mitigations](https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition) are automatically applied by the container startup process.
+
 ## Contributing
     
 See [Development](DEVELOPMENT.md) and [Building](BUILDING.md).

files/auto/autopause-daemon.sh

@@ -10,7 +10,7 @@ fi
 
 autopause_error_loop() {
   logAutopause "Available interfaces within the docker container:"
-  logAutopause "  $(available_interfaces)"
+  logAutopause "  $(mc-image-helper network-interfaces)"
   logAutopause "Please set the environment variable AUTOPAUSE_KNOCK_INTERFACE to the interface that handles incoming connections."
   logAutopause "If unsure which interface to choose, run the ifconfig command in the container."
   logAutopause "Autopause failed to initialize. This log entry will be printed every 30 minutes."
@@ -35,7 +35,7 @@ if [[ -z "$AUTOPAUSE_KNOCK_INTERFACE" ]] ; then
   logAutopause "AUTOPAUSE_KNOCK_INTERFACE variable must not be empty!"
   autopause_error_loop
 fi
-if ! available_interfaces | grep -q "$AUTOPAUSE_KNOCK_INTERFACE" ; then
+if ! mc-image-helper network-interfaces --check="$AUTOPAUSE_KNOCK_INTERFACE" ; then
   logAutopause "Selected interface \"$AUTOPAUSE_KNOCK_INTERFACE\" does not exist!"
   autopause_error_loop
 fi

files/auto/autopause-fcns.sh

@@ -34,8 +34,4 @@ java_clients_connections() {
 
 java_clients_connected() {
   (( $(java_clients_connections) > 0 ))
-}
-
-available_interfaces() {
-  ifconfig -s | tail +2 | cut -f1 -d ' '
-}
+}

files/cf-exclude-include.json

@@ -2,6 +2,7 @@
   "globalExcludes": [
     "carry-on",
     "defensive-measures",
+    "dynamiclights-reforged",
     "entity-texture-features-fabric",
     "entityculling",
     "extreme-sound-muffler",
@@ -12,6 +13,7 @@
     "oculus",
     "rubidium",
     "rubidium-extra",
+    "magnesium-extras",
     "skin-layers-3d",
     "textrues-rubidium-options",
     "torohealth-damage-indicators"
@@ -23,4 +25,4 @@
       ]
     }
   }
-}
+}

scripts/start-setupModpack

@@ -183,7 +183,7 @@ esac
 fi
 }
 
-function genericPacks() {
+function handleGenericPacks() {
   : "${GENERIC_PACKS:=${GENERIC_PACK}}"
   : "${GENERIC_PACKS_PREFIX:=}"
   : "${GENERIC_PACKS_SUFFIX:=}"
@@ -267,7 +267,7 @@ function genericPacks() {
   fi
 }
 
-function modrinthProjects() {
+function handleModrinthProjects() {
   : "${MODRINTH_PROJECTS:=}"
   : "${MODRINTH_DOWNLOAD_OPTIONAL_DEPENDENCIES:=true}"
   : "${MODRINTH_ALLOWED_VERSION_TYPE:=release}"
@@ -275,8 +275,11 @@ function modrinthProjects() {
   if [[ $MODRINTH_PROJECTS ]] && isFamily HYBRID FORGE FABRIC SPIGOT; then
     if isFamily HYBRID FORGE; then
       loader=forge
+    elif isFaily FABRIC; then
+      loader=fabric
     else
-      loader="${FAMILY,,}"
+      # we're left with Bukkit/Spigot down-lines where plugins seem to be
+      loader="${TYPE,,}"
     fi
     mc-image-helper modrinth \
       --output-directory=/data \
@@ -294,8 +297,8 @@ handleModpackListOrFile
 
 handleCurseForgeManifest
 
-genericPacks
+handleGenericPacks
 
-modrinthProjects
+handleModrinthProjects
 
 exec "${SCRIPTS:-/}start-setupModconfig" "$@"

scripts/start-setupMounts

@@ -24,47 +24,52 @@ else
   subcommand=sync
 fi
 
-if [ -d /plugins ]; then
+: "${COPY_PLUGINS_SRC:="/plugins"}"
+: "${COPY_PLUGINS_DEST:="/data/plugins"}"
+
+if [ -d "${COPY_PLUGINS_SRC}" ]; then
   case ${FAMILY} in
     SPIGOT|HYBRID)
-      mkdir -p /data/plugins
-      log "Copying plugins over..."
+      mkdir -p "${COPY_PLUGINS_DEST}"
+      log "Copying any plugins from ${COPY_PLUGINS_SRC} to ${COPY_PLUGINS_DEST}"
       mc-image-helper \
         ${subcommand} $updateArg \
         --replace-env-file-suffixes="${REPLACE_ENV_SUFFIXES}" \
         --replace-env-excludes="${REPLACE_ENV_VARIABLES_EXCLUDES}" \
         --replace-env-exclude-paths="${REPLACE_ENV_VARIABLES_EXCLUDE_PATHS}" \
         --replace-env-prefix="${REPLACE_ENV_VARIABLE_PREFIX}" \
-        /plugins /data/plugins
+        "${COPY_PLUGINS_SRC}" "${COPY_PLUGINS_DEST}"
       ;;
   esac
 fi
 
 # If any modules have been provided, copy them over
+: "${COPY_MODS_SRC:="/mods"}"
 : "${COPY_MODS_DEST:="/data/mods"}"
 
-if [ -d /mods ]; then
-  log "Copying any mods over..."
+if [ -d "${COPY_MODS_SRC}" ]; then
+  log "Copying any mods from ${COPY_MODS_SRC} to ${COPY_MODS_DEST}"
   mc-image-helper \
     ${subcommand} $updateArg \
     --replace-env-file-suffixes="${REPLACE_ENV_SUFFIXES}" \
     --replace-env-excludes="${REPLACE_ENV_VARIABLES_EXCLUDES}" \
     --replace-env-exclude-paths="${REPLACE_ENV_VARIABLES_EXCLUDE_PATHS}" \
     --replace-env-prefix="${REPLACE_ENV_VARIABLE_PREFIX}" \
-    /mods "${COPY_MODS_DEST}"
+    "${COPY_MODS_SRC}" "${COPY_MODS_DEST}"
 fi
 
+: "${COPY_CONFIG_SRC:="/config"}"
 : "${COPY_CONFIG_DEST:="/data/config"}"
 
-if [ -d /config ]; then
-  log "Copying any configs from /config to ${COPY_CONFIG_DEST}"
+if [ -d "${COPY_CONFIG_SRC}" ]; then
+  log "Copying any configs from ${COPY_CONFIG_SRC} to ${COPY_CONFIG_DEST}"
   mc-image-helper \
     ${subcommand} $updateArg \
     --replace-env-file-suffixes="${REPLACE_ENV_SUFFIXES}" \
     --replace-env-excludes="${REPLACE_ENV_VARIABLES_EXCLUDES}" \
     --replace-env-exclude-paths="${REPLACE_ENV_VARIABLES_EXCLUDE_PATHS}" \
     --replace-env-prefix="${REPLACE_ENV_VARIABLE_PREFIX}" \
-    /config "${COPY_CONFIG_DEST}"
+    "${COPY_CONFIG_SRC}" "${COPY_CONFIG_DEST}"
 fi
 
 exec "${SCRIPTS:-/}start-setupServerProperties" "$@"

tests/setuponlytests/mounts-custom/custom/config/test.json

@@ -0,0 +1 @@
+{}

tests/setuponlytests/mounts-custom/docker-compose.yml

@@ -0,0 +1,21 @@
+version: "3"
+
+services:
+  mc:
+    image: ${IMAGE_TO_TEST:-itzg/minecraft-server}
+    environment:
+      EULA: "true"
+      SETUP_ONLY: "true"
+      TYPE: CUSTOM
+      CUSTOM_SERVER: /servers/fake.jar
+      VERSION: 1.18.1
+      COPY_PLUGINS_SRC: /custom/plugins
+      COPY_PLUGINS_DEST: /data/custom-plugins
+      COPY_MODS_SRC: /custom/mods
+      COPY_MODS_DEST: /data/custom-mods
+      COPY_CONFIG_SRC: /custom/config
+      COPY_CONFIG_DEST: /data/custom-config
+    volumes:
+      - ./data:/data
+      - ./custom:/custom
+      - ./fake.jar:/servers/fake.jar

tests/setuponlytests/mounts-custom/verify.sh

@@ -0,0 +1,3 @@
+mc-image-helper assert fileExists custom-plugins/plugin.jar
+mc-image-helper assert fileExists custom-mods/mod.jar
+mc-image-helper assert fileExists custom-config/test.json