Bump latest/stable image variant to java25 (#3845)

.github/workflows/build.yml

@@ -92,27 +92,27 @@ jobs:
             platforms: linux/amd64,linux/arm/v7,linux/arm64
             mcVersion: 1.12.2
             # Pin version for Java 8
-#            mcHelperVersion: 1.46.0
+            mcHelperVersion: 1.51.1
           - variant: java8-graalvm-ce
             baseImage: ghcr.io/graalvm/graalvm-ce:java8
             platforms: linux/amd64
             mcVersion: 1.12.2
             # Pin version for Java 8
-#            mcHelperVersion: 1.46.0
+            mcHelperVersion: 1.51.1
           - variant: java8-jdk
             baseImage: eclipse-temurin:8u312-b07-jdk-focal
             platforms: linux/amd64,linux/arm64
             mcVersion: 1.12.2
             # Pin version for Java 8
-#            mcHelperVersion: 1.46.0
+            mcHelperVersion: 1.51.1
     env:
       IMAGE_TO_TEST: "${{ github.repository_owner }}/minecraft-server:test-${{ matrix.variant }}-${{ github.run_id }}"
       HAS_IMAGE_REPO_ACCESS: ${{ secrets.DOCKER_USER != '' && secrets.DOCKER_PASSWORD != '' }}
-      MAIN_VARIANT: java21
+      MAIN_VARIANT: java25
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.0
+        uses: actions/checkout@v6.0.1
         with:
           # for build-files step
           fetch-depth: 0
@@ -149,7 +149,7 @@ jobs:
             org.opencontainers.image.authors=Geoff Bourne <itzgeoff@gmail.com>
 
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@v3.11.1
+        uses: docker/setup-buildx-action@v3.12.0
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3.7.0

.github/workflows/verify-pr.yml

@@ -1,8 +1,8 @@
 name: Verify PR
 on:
   pull_request:
-    branches: [ master ]
-    types: [assigned, opened, synchronize, labeled]
+    branches:
+      - master
     paths-ignore:
       - "*.md"
       - "docs/**"
@@ -19,14 +19,14 @@ jobs:
       fail-fast: false
       matrix:
         variant:
-          - java21
+          - java25
           - java21-alpine
           - java17
           - java8
         include:
-        # JAVA 21:
-          - variant: java21
-            baseImage: eclipse-temurin:21-jre
+        # JAVA 21/25:
+          - variant: java25
+            baseImage: eclipse-temurin:25-jre
             platforms: linux/amd64,linux/arm64
             mcVersion: latest
           - variant: java21-alpine
@@ -44,19 +44,19 @@ jobs:
             platforms: linux/amd64
             mcVersion: 1.12.2
             # Pin version for Java 8
-#            mcHelperVersion: 1.42.1
+            mcHelperVersion: 1.51.1
     env:
       IMAGE_TO_TEST: ${{ github.repository_owner }}/minecraft-server:test-${{ matrix.variant }}-${{ github.run_id }}
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.0
+        uses: actions/checkout@v6.0.1
         with:
           # for build-files step
           fetch-depth: 0
 
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@v3.11.1
+        uses: docker/setup-buildx-action@v3.12.0
 
       - name: Confirm multi-arch build
         uses: docker/build-push-action@v6.18.0

Dockerfile

@@ -1,4 +1,4 @@
-ARG BASE_IMAGE=eclipse-temurin:21-jre
+ARG BASE_IMAGE=eclipse-temurin:25-jre
 FROM ${BASE_IMAGE}
 
 # hook into docker BuildKit --platform support
@@ -44,12 +44,12 @@ RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --var version=${MC_MONITOR_VERSION} --var app=mc-monitor --file {{.app}} \
   --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
-ARG MC_SERVER_RUNNER_VERSION=1.14.0
+ARG MC_SERVER_RUNNER_VERSION=1.14.1
 RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --var version=${MC_SERVER_RUNNER_VERSION} --var app=mc-server-runner --file {{.app}} \
   --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
-ARG MC_HELPER_VERSION=1.51.1
+ARG MC_HELPER_VERSION=1.52.1
 ARG MC_HELPER_BASE_URL=${GITHUB_BASEURL}/itzg/mc-image-helper/releases/download/${MC_HELPER_VERSION}
 # used for cache busting local copy of mc-image-helper
 ARG MC_HELPER_REV=1

docs/configuration/misc-options.md

@@ -77,15 +77,68 @@ The openj9 image tags include specific variables to simplify configuration:
 - `-e TUNE_NURSERY_SIZES=TRUE` : configures nursery sizes where the initial size is 50%
   of the `MAX_MEMORY` and the max size is 80%.
 
-## Enabling rolling logs
+## Customizing log4j2 configuration
 
-By default the vanilla log file will grow without limit. The logger can be reconfigured to use a rolling log files strategy by using:
+The image now uses a templated log4j2 configuration based on PaperMC's logging setup, which is automatically applied for versions that don't require Log4j security patches. This configuration provides rolling logs and advanced logging features by default.
 
-```
-  -e ENABLE_ROLLING_LOGS=true
+### Customization via environment variables
+
+You can customize various aspects of the logging behavior using environment variables:
+
+- `LOG_LEVEL` : Root logger level (default: `info`)
+  ```
+  -e LOG_LEVEL=debug
+  ```
+
+- `ROLLING_LOG_FILE_PATTERN` : Pattern for rolled log file names (default: `logs/%d{yyyy-MM-dd}-%i.log.gz`)
+  ```
+  -e ROLLING_LOG_FILE_PATTERN="logs/archive/%d{yyyy-MM-dd}-%i.log.gz"
+  ```
+
+- `ROLLING_LOG_MAX_FILES` : Maximum number of archived log files to keep (default: `1000`)
+  ```
+  -e ROLLING_LOG_MAX_FILES=30
+  ```
+
+### Customizing log message formats
+
+For full control over how log messages are formatted, you can customize the Log4j2 pattern layouts using these variables. These use [Log4j2 Pattern Layout syntax](https://logging.apache.org/log4j/2.x/manual/layouts.html#PatternLayout):
+
+- `LOG_CONSOLE_FORMAT` : Format for console output (what you see in `docker logs`)
+  Default: `[%d{HH:mm:ss}] [%t/%level]: %msg%n`
+
+- `LOG_FILE_FORMAT` : Format for file logs (written to `logs/latest.log`)
+  Default: `[%d{HH:mm:ss}] [%t/%level]: %msg%n`
+
+- `LOG_TERMINAL_FORMAT` : Format for interactive terminal console (used with `docker attach`)
+  Default: `[%d{HH:mm:ss} %level]: %msg%n`
+
+### Example configurations
+
+Simple timestamp customization (most common use case):
+```yaml
+environment:
+  # What you see in docker logs
+  LOG_CONSOLE_FORMAT: "[%d{yyyy-MM-dd HH:mm:ss.SSS}] [%t/%level]: %msg%n"
+  # What gets written to logs/latest.log
+  LOG_FILE_FORMAT: "[%d{yyyy-MM-dd HH:mm:ss.SSS}] [%t/%level]: %msg%n"
 ```
 
-> **NOTE** this will interfere with interactive/color consoles [as described in the section above](#interactive-and-color-console)
+Advanced customization:
+```yaml
+environment:
+  LOG_LEVEL: debug
+  # Custom ISO8601 format with logger names
+  LOG_CONSOLE_FORMAT: "%d{ISO8601} %-5level [%t] %logger{36} - %msg%n"
+  LOG_FILE_FORMAT: "%d{ISO8601} %-5level [%t] %logger{36} - %msg%n"
+  ROLLING_LOG_MAX_FILES: 50
+```
+
+### Legacy ENABLE_ROLLING_LOGS option
+
+The `ENABLE_ROLLING_LOGS` environment variable is no longer needed for most use cases, as rolling logs are now enabled by default through the templated configuration. This option is maintained for backward compatibility but is only checked for error reporting when rolling logs cannot be used due to Log4j security patches.
+
+> **NOTE** The templated log4j2 configuration may interfere with interactive/color consoles [as described in the section above](#interactive-and-color-console)
 
 ## Timezone Configuration
 

docs/configuration/server-properties.md

@@ -238,15 +238,46 @@ By default an existing `server-icon.png` file will not be replaced, that can be
 
 ### RCON
 
-RCON is **enabled by default** to allow for graceful shut down the server and coordination of save state during backups. RCON can be disabled by setting `ENABLE_RCON` to "false".
+RCON is **enabled by default** to allow for graceful shut down of the server and coordination of save state during backups. RCON can be disabled by setting `ENABLE_RCON` to "false".
 
 !!! warning
 
     Disabling RCON will remove and limit some features, such as interactive and color console support.
 
-The default password is randomly generated on each startup; however, a specific one can be set with `RCON_PASSWORD`.
+#### RCON Password
 
-**DO NOT MAP THE RCON PORT EXTERNALLY** unless you are aware of all the consequences and have set a **secure password** with `RCON_PASSWORD`. 
+The default password is randomly generated on each startup. However, you can specify a password using one of the following environment variables:
+
+* Set `RCON_PASSWORD` to your desired password.
+* Set `RCON_PASSWORD_FILE` to the path of a file containing the password.
+
+Using `RCON_PASSWORD_FILE` is the recommended method for managing sensitive data, as it allows full support for [Docker Secrets](https://docs.docker.com/compose/how-tos/use-secrets/).
+
+??? example
+    ```yaml title="compose.yaml"
+    services:
+      mc:
+        image: itzg/minecraft-server:latest
+        pull_policy: daily
+        tty: true
+        stdin_open: true
+        ports:
+          - "25565:25565"
+        environment:
+          EULA: "TRUE"
+          RCON_PASSWORD_FILE: /run/secrets/rcon_pass # Points to the path where the secret is mounted
+        volumes:
+          # attach the relative directory 'data' to the container's /data path
+          - ./data:/data
+        secrets:
+          - rcon_pass
+    
+    secrets:
+      rcon_pass:
+        file: ./rcon_password # local file containing the password
+    ```
+!!! warning
+    **BE CAUTIOUS OF MAPPING THE RCON PORT EXTERNALLY** unless you are aware of all the consequences and have set a **secure password**.
 
 !!! info 
 
@@ -444,4 +475,4 @@ When using `docker run` from a bash shell, the entries must be quoted with the `
 | STATUS_HEARTBEAT_INTERVAL               | [status-heartbeat-interval](https://minecraft.wiki/w/Server.properties#status-heartbeat-interval)                             |
 | SYNC_CHUNK_WRITES                       | [sync-chunk-writes](https://minecraft.wiki/w/Server.properties#sync-chunk-writes)                                             |
 | USE_NATIVE_TRANSPORT                    | [use-native-transport](https://minecraft.wiki/w/Server.properties#use-native-transport)                                       |
-| VIEW_DISTANCE                           | [view-distance](https://minecraft.wiki/w/Server.properties#view-distance)                                                     |
+| VIEW_DISTANCE                           | [view-distance](https://minecraft.wiki/w/Server.properties#view-distance)                                                     |

docs/index.md

@@ -35,7 +35,7 @@ where, in this case, the standard server port 25565 will be exposed on your host
         # ... image and environment section
         volumes:
           # attach the relative directory 'data' to the container's /data path
-          ./data:data
+          - ./data:data
     ```
 
 !!! note
@@ -84,3 +84,4 @@ Follow the logs of the container using `docker compose logs -f`, check on the st
 
 !!! note "Deployment Examples"
     The [deployments page](misc/deployment/index.md) provides more examples of deployment with and beyond Docker Compose.
+

docs/misc/autopause-autostop/autopause.md

@@ -22,8 +22,6 @@ A `.skip-pause` file can be created in the `/data` directory to make the server
 
 A starting, example compose file has been provided in [the examples](https://github.com/itzg/docker-minecraft-server/blob/master/examples/autopause/compose.yml).
 
-Auto-pause is not compatible with `EXEC_DIRECTLY=true` and the two cannot be set together.
-
 !!! note 
 
     When configuring kubernetes readiness/liveness health checks with auto-pause enabled, be sure to reference the `mc-health` wrapper script rather than `mc-status` directly.

docs/sending-commands/commands.md

@@ -25,8 +25,8 @@ If rcon is disabled you can send commands by passing them as arguments to the pa
 
 ```shell
 docker exec --user 1000 mc mc-send-to-console op player
-            |                     |
-            +- container name     +- Minecraft commands start here
+                        |                     |
+                        +- container name     +- Minecraft commands start here
 ```
 
 ## Enabling interactive console

docs/sending-commands/ssh.md

@@ -0,0 +1,70 @@
+---
+title: Over SSH
+---
+
+The container can host an SSH console. It is enabled by setting `ENABLE_SSH` to `true`.
+The SSH server only supports password based authentication. The password is the same as the RCON password.
+
+!!! question
+    See [the RCON password](../configuration/server-properties.md/#rcon-password) section under configuration/server-properties for more information on how to set an RCON password.
+
+The SSH server runs on port `2222` inside the container.
+
+??? tip "Tip: Exposing the SSH port"
+
+    !!! warning "Security Implications"
+        By default, publishing ports in Docker binds them to all network interfaces (`0.0.0.0`), making the SSH console accessible to any device that can reach your host machine.
+        
+        Since the SSH console grants **full administrative access** to your server, it is critical to use a strong [RCON password](../configuration/server-properties.md/#rcon-password). 
+        
+        If you wish to restrict access to the local machine only, refer to the [Docker documentation](https://docs.docker.com/engine/network/port-publishing/#publishing-ports) on binding to specific IP addresses (e.g., `127.0.0.1:2222:2222`).
+      
+        If SSH access is only intended for inter-container connections, consider **NOT** forwarding the port to the host machine, and putting the containers in a shared [Docker network](https://docs.docker.com/engine/network/#user-defined-networks).
+
+    ```yaml title="compose.yaml"
+    services:
+      mc:
+        ports:
+          - '25565:25565'
+          - '2222:2222'
+    ```
+
+## Connecting
+
+Connecting should be as simple as running
+```bash
+ssh anyuser@127.0.0.1 -p 2222
+```
+and typing in the RCON password.
+
+## Environment variables
+
+| Environment Variable | Usage                     | Default |
+| -------------------- | ------------------------- | ------- |
+| `ENABLE_SSH`   | Enable remote SSH console | `false` |
+
+
+## Example
+
+```yaml title="compose.yaml"
+services:
+  mc:
+    image: itzg/minecraft-server:latest
+    pull_policy: daily
+    tty: true
+    stdin_open: true
+    ports:
+      - "25565:25565"
+      - "2222:2222"
+    environment:
+      EULA: "TRUE"
+      ENABLE_SSH: true
+      RCON_PASSWORD_FILE: /run/secrets/rcon_pass
+    volumes:
+      # attach the relative directory 'data' to the container's /data path
+      - ./data:/data
+    
+secrets:
+  rcon_pass:
+    file: ./rcon_password
+```

docs/sending-commands/websocket.md

@@ -1,9 +1,9 @@
 ---
-title: With websocket
+title: With WebSocket
 ---
 
-With `WEBSOCKET_CONSOLE` set to `true`, logs can be streamed, and commands sent, over a websocket connection.
-The API is available on `/websocket`.
+With `WEBSOCKET_CONSOLE` set to `true`, logs can be streamed, and commands sent, over a WebSocket connection.
+The API is available on `/console`.
 
 ## Password
 A password must be supplied using the `Sec-WebSocket-Protocol` header. This is done by putting `mc-server-runner-ws-v1` in the first slot, and the password in the second. The password can be set with `RCON_PASSWORD` or `WEBSOCKET_PASSWORD`. The latter overwrites the former. Authentication can be disabled with `WEBSOCKET_DISABLE_AUTHENTICATION`.
@@ -21,7 +21,16 @@ The listen address and port can be set with `WEBSOCKET_ADDRESS` (defaults to `0.
 ## Log history
 When a connection is established, the last 50 (by default, configurable with `WEBSOCKET_LOG_BUFFER_SIZE`) log lines are sent with a `logHistory` type message.
 
-??? tip "Tip: Remember to forward the websocket port on the host"
+??? tip "Tip: Remember to forward the WebSocket port on the host"
+
+    !!! warning "Security Implications"
+        By default, publishing ports in Docker binds them to all network interfaces (`0.0.0.0`), making the WebSocket console accessible to any device that can reach your host machine.
+        
+        Since the WebSocket console grants **full administrative access** to your server, it is critical to use a strong [WebSocket password](#password) or [RCON password](../configuration/server-properties.md/#rcon-password).
+      
+        If you wish to restrict access to the local machine only, refer to the [Docker documentation](https://docs.docker.com/engine/network/port-publishing/#publishing-ports) on binding to specific IP addresses (e.g., `127.0.0.1:80:80`).
+        
+        If WebSocket access is only intended for inter-container connections, consider **NOT** forwarding the port to the host machine, and putting the containers in a shared [Docker network](https://docs.docker.com/engine/network/#user-defined-networks).
 
     ```yaml title="compose.yaml"
     services:
@@ -34,12 +43,12 @@ When a connection is established, the last 50 (by default, configurable with `WE
 ## Environment variables
 | Environment Variable               | Usage                                                      | Default      |
 | ---------------------------------- | ---------------------------------------------------------- | ------------ |
-| `WEBSOCKET_CONSOLE`                | Allow remote shell over websocket                          | `false`      |
-| `WEBSOCKET_ADDRESS`                | Bind address for websocket server                          | `0.0.0.0:80` |
+| `WEBSOCKET_CONSOLE`                | Allow remote shell over WebSocket                          | `false`      |
+| `WEBSOCKET_ADDRESS`                | Bind address for WebSocket server                          | `0.0.0.0:80` |
 | `WEBSOCKET_DISABLE_ORIGIN_CHECK`   | Disable checking if origin is trusted                      | `false`      |
 | `WEBSOCKET_ALLOWED_ORIGINS`        | Comma-separated list of trusted origins                    | ` `          |
 | `WEBSOCKET_PASSWORD`               | Password will be the same as RCON_PASSWORD if unset        | ` `          |
-| `WEBSOCKET_DISABLE_AUTHENTICATION` | Disable websocket authentication                           | `false`      |
+| `WEBSOCKET_DISABLE_AUTHENTICATION` | Disable WebSocket authentication                           | `false`      |
 | `WEBSOCKET_LOG_BUFFER_SIZE`        | Number of log lines to save and send to connecting clients | `50`         |
 
 ## API Schema

docs/variables.md

@@ -57,9 +57,45 @@ alternatively, you can mount: <code>/etc/localtime:/etc/localtime:ro
             <td><code>UTC</code></td>
             <td>⬜️</td>
         </tr>
+        <tr>
+            <td><code>LOG_LEVEL</code></td>
+            <td>Root logger level (trace, debug, info, warn, error)</td>
+            <td><code>info</code></td>
+            <td>⬜️</td>
+        </tr>
+        <tr>
+            <td><code>LOG_CONSOLE_FORMAT</code></td>
+            <td>Log4j2 pattern for console output (what you see in <code>docker logs</code>)</td>
+            <td><code>[%d{HH:mm:ss}] [%t/%level]: %msg%n</code></td>
+            <td>⬜️</td>
+        </tr>
+        <tr>
+            <td><code>LOG_FILE_FORMAT</code></td>
+            <td>Log4j2 pattern for file logs (written to <code>logs/latest.log</code>)</td>
+            <td><code>[%d{HH:mm:ss}] [%t/%level]: %msg%n</code></td>
+            <td>⬜️</td>
+        </tr>
+        <tr>
+            <td><code>LOG_TERMINAL_FORMAT</code></td>
+            <td>Log4j2 pattern for interactive terminal console (used with <code>docker attach</code>)</td>
+            <td><code>[%d{HH:mm:ss} %level]: %msg%n</code></td>
+            <td>⬜️</td>
+        </tr>
+        <tr>
+            <td><code>ROLLING_LOG_FILE_PATTERN</code></td>
+            <td>Pattern for rolled/archived log file names</td>
+            <td><code>logs/%d{yyyy-MM-dd}-%i.log.gz</code></td>
+            <td>⬜️</td>
+        </tr>
+        <tr>
+            <td><code>ROLLING_LOG_MAX_FILES</code></td>
+            <td>Maximum number of archived log files to keep</td>
+            <td><code>1000</code></td>
+            <td>⬜️</td>
+        </tr>
         <tr>
             <td><code>ENABLE_ROLLING_LOGS</code></td>
-            <td>By default the vanilla log file will grow without limit. The logger can be reconfigured to use a rolling log files strategy by setting this to <code>true</code></td>
+            <td><strong>Legacy option.</strong> Rolling logs are now enabled by default via templated log4j2 configuration. This option is maintained for backward compatibility but only used for error reporting</td>
             <td><code>false</code></td>
             <td>⬜️</td>
         </tr>
@@ -403,12 +439,6 @@ alternatively, you can mount: <code>/etc/localtime:/etc/localtime:ro
             <td><code></code></td>
             <td>⬜️</td>
         </tr>
-        <tr>
-            <td><code>EXEC_DIRECTLY</code></td>
-            <td>If you would like to docker attach to the Minecraft server console with color and interactive capabilities, then set to <code>true</code></td>
-            <td><code>false</code></td>
-            <td>⬜️</td>
-        </tr>
         <tr>
             <td><code>STOP_SERVER_ANNOUNCE_DELAY</code></td>
             <td>To allow time for players to finish what they're doing during a graceful server shutdown, set <code>STOP_SERVER_ANNOUNCE_DELAY</code> to a number of seconds to delay after an announcement is posted by the server.</td>
@@ -609,10 +639,6 @@ alternatively, you can mount: <code>/etc/localtime:/etc/localtime:ro
 
 ### Auto-Pause
 
-!!! note
-
-    Autopause is not compatible with `EXEC_DIRECTLY=true` and the two cannot be set together.
-
 <table>
     <thead>
         <tr>

docs/versions/java.md

@@ -12,17 +12,17 @@ where `<tag>` refers to the first column of this table:
 
 | Tag            | Java version | Linux  | JVM Type           | Architecture        | Note |
 |----------------|--------------|--------|--------------------|---------------------|------|
-| latest         | 21           | Ubuntu | Hotspot            | amd64, arm64        |      |
-| stable         | 21           | Ubuntu | Hotspot            | amd64, arm64        |      |
+| latest         | 25           | Ubuntu | Hotspot            | amd64, arm64        |      |
+| stable         | 25           | Ubuntu | Hotspot            | amd64, arm64        |      |
 | java25         | 25           | Ubuntu | Hotspot            | amd64, arm64        |      |
 | java25-jdk     | 25           | Ubuntu | Hotspot+JDK        | amd64, arm64        |      |
-| java25-graalvm | 25           | Oracle | Oracle GraalVM (3) | amd64, arm64        |      |   
+| java25-graalvm | 25           | Oracle | Oracle GraalVM (3) | amd64, arm64        | (5)  |   
 | java21         | 21           | Ubuntu | Hotspot            | amd64, arm64        |      |
 | java21-jdk     | 21           | Ubuntu | Hotspot+JDK        | amd64, arm64        |      |
 | java21-alpine  | 21           | Alpine | Hotspot            | amd64, arm64        |      |
-| java21-graalvm | 21           | Oracle | Oracle GraalVM (3) | amd64, arm64        |      |   
+| java21-graalvm | 21           | Oracle | Oracle GraalVM (3) | amd64, arm64        | (5)  |   
 | java17         | 17           | Ubuntu | Hotspot            | amd64, arm64, armv7 |      |
-| java17-graalvm | 17           | Oracle | Oracle GraalVM (3) | amd64, arm64        |      |   
+| java17-graalvm | 17           | Oracle | Oracle GraalVM (3) | amd64, arm64        | (5)  |   
 | java16         | 16           | Ubuntu | Hotspot            | amd64, arm64, armv7 | (4)  |
 | java11         | 11           | Ubuntu | Hotspot            | amd64, arm64, armv7 |      |
 | java8          | 8            | Ubuntu | Hotspot            | amd64, arm64, armv7 |      |
@@ -33,6 +33,7 @@ Notes
 2. Short-term variant, subject to deprecation upon next version introduction
 3. Based on the [Oracle GraalVM images](https://blogs.oracle.com/java/post/new-oracle-graalvm-container-images), which as of JDK 17, are now under the [GraalVM Free License](https://blogs.oracle.com/java/post/graalvm-free-license) incorporating what used to be known as the GraalVM Enterprise.
 4. This version of Java is [recommended for PaperMC 1.16.5](https://docs.papermc.io/paper/getting-started/#requirements)
+5. Due to these images using Oracle Linux, (which is based on Red Hat Enterprise Linux) Forge Installer will not work due to its use of zlib-ng. Use other images for initial installation and Forge version upgrade.
 
 !!! example "Example using java8"
 
@@ -144,4 +145,5 @@ The following image tags have been deprecated and are no longer receiving update
 
 ## JSON Listing
 
-Information about the image tags is available for programmatic access at <https://raw.githubusercontent.com/itzg/docker-minecraft-server/refs/heads/master/images.json>
+
+Information about the image tags is available for programmatic access at <https://raw.githubusercontent.com/itzg/docker-minecraft-server/refs/heads/master/images.json>

docs/versions/minecraft.md

@@ -1,8 +1,8 @@
 To use a different Minecraft version, pass the `VERSION` environment variable (case sensitive), which can have the value
 
-- LATEST (the default)
-- SNAPSHOT
-- a specific version, such as "1.7.9"
+- `LATEST` for latest release (the default)
+- `SNAPSHOT` for latest snapshot
+- a specific version, such as `1.7.9`, `25w35a`, `26.1`, or `26.1-snapshot-1`
 - or an alpha and beta version, such as "b1.7.3" (server download might not exist)
 
 For example, to use the latest snapshot:

examples/docker-compose-curseforge-atm7.yaml

@@ -110,9 +110,20 @@ services:
 ####################################################################
 #                         Logging Options                          #
 #                                                                  #
-# Set to "true" to delete old logs                                 #
+# Rolling logs are now enabled by default with templated           #
+# log4j2 configuration. You can customize:                         #
+#                                                                  #
+# LOG_LEVEL: Log level (default: info)                             #
+# LOG_CONSOLE_FORMAT: Console output format (docker logs)          #
+# LOG_FILE_FORMAT: File log format (logs/latest.log)               #
+# ROLLING_LOG_MAX_FILES: Max archived files (default: 1000)        #
+#                                                                  #
+# Example: Add full timestamp to logs                              #
+# LOG_CONSOLE_FORMAT: "[%d{yyyy-MM-dd HH:mm:ss}] [%t/%level]: %msg%n"
+# LOG_FILE_FORMAT: "[%d{yyyy-MM-dd HH:mm:ss}] [%t/%level]: %msg%n"
+#                                                                  #
+# ENABLE_ROLLING_LOGS is now legacy and no longer needed.          #
 ####################################################################
-      ENABLE_ROLLING_LOGS: "true"
 
 ####################################################################
 #                          Server Timezone                         #

examples/docker-compose-forge-bettermcplus

@@ -120,9 +120,20 @@ services:
 ####################################################################
 #                         Logging Options                          #
 #                                                                  #
-# Set to "true" to delete old logs                                 #
+# Rolling logs are now enabled by default with templated           #
+# log4j2 configuration. You can customize:                         #
+#                                                                  #
+# LOG_LEVEL: Log level (default: info)                             #
+# LOG_CONSOLE_FORMAT: Console output format (docker logs)          #
+# LOG_FILE_FORMAT: File log format (logs/latest.log)               #
+# ROLLING_LOG_MAX_FILES: Max archived files (default: 1000)        #
+#                                                                  #
+# Example: Add full timestamp to logs                              #
+# LOG_CONSOLE_FORMAT: "[%d{yyyy-MM-dd HH:mm:ss}] [%t/%level]: %msg%n"
+# LOG_FILE_FORMAT: "[%d{yyyy-MM-dd HH:mm:ss}] [%t/%level]: %msg%n"
+#                                                                  #
+# ENABLE_ROLLING_LOGS is now legacy and no longer needed.          #
 ####################################################################
-      ENABLE_ROLLING_LOGS: "true"
 
 ####################################################################
 #                          Server Timezone                         #

files/cf-exclude-include.json

@@ -35,6 +35,7 @@
     "controllable",
     "controlling",
     "craftpresence",
+    "crash-assistant",
     "cull-less-leaves",
     "ctm",
     "custom-main-menu",
@@ -183,7 +184,10 @@
       "forceIncludes": ["just-enough-resources-jer"]
     },
     "ftb-stoneblock-4": {
-      "forceIncludes": ["particular-reforged"]
+      "forceIncludes": [
+        "particular-reforged",
+        "ctm"
+      ]
     },
     "mc-eternal-2": {
       "forceIncludes": [

files/log4j2.xml

@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Configuration status="WARN">
-    <Appenders>
-        <Console name="SysOut" target="SYSTEM_OUT">
-            <PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" />
-        </Console>
-        <Queue name="TerminalConsole">
-            <PatternLayout pattern="[%d{HH:mm:ss} %level]: %msg%n" />
-        </Queue>
-        <RollingRandomAccessFile name="File" fileName="logs/latest.log" filePattern="logs/%d{yyyy-MM-dd}-%i.log.gz">
-            <PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" />
-            <Policies>
-                <!-- Based on filePattern resolution, so daily -->
-                <TimeBasedTriggeringPolicy />
-                <SizeBasedTriggeringPolicy size="100 MB" />
-                <OnStartupTriggeringPolicy />
-            </Policies>
-            <DefaultRolloverStrategy>
-                <Delete basePath="logs">
-                    <IfFileName glob="*.log.gz" />
-                    <IfLastModified age="7d" />
-                    <IfAccumulatedFileCount exceeds="20"/>
-                </Delete>
-            </DefaultRolloverStrategy>
-        </RollingRandomAccessFile>
-    </Appenders>
-    <Loggers>
-        <Root level="info">
-            <filters>
-                <MarkerFilter marker="NETWORK_PACKETS" onMatch="DENY" onMismatch="NEUTRAL" />
-            </filters>
-            <AppenderRef ref="SysOut"/>
-            <AppenderRef ref="File"/>
-            <AppenderRef ref="TerminalConsole"/>
-        </Root>
-    </Loggers>
-</Configuration>

files/modrinth-exclude-include.json

@@ -32,6 +32,7 @@
     "continuity",
     "controlling",
     "craftpresence",
+    "CrashAssistant",
     "Cull Less Leaves",
     "cwb",
     "DisableCustomWorldsAdvice",

scripts/start-configuration

@@ -28,7 +28,11 @@ shopt -s nullglob
 
 isDebugging && set -x
 
-#umask 002
+if (( $(mc-image-helper java-release) >= 17 )); then
+  MC_IMAGE_HELPER_OPTS+=" --enable-native-access=ALL-UNNAMED"
+  export MC_IMAGE_HELPER_OPTS
+fi
+
 export HOME=/data
 
 log "Running as uid=$(id -u) gid=$(id -g) with /data as '$(ls -lnd /data)'"
@@ -91,11 +95,6 @@ fi
 ##########################################
 # Auto-pause/stop
 
-if isTrue "${ENABLE_AUTOPAUSE}" && isTrue "${EXEC_DIRECTLY:-false}"; then
-    logError "EXEC_DIRECTLY=true is incompatible with ENABLE_AUTOPAUSE=true"
-    exit 1
-fi
-
 if isTrue "${ENABLE_AUTOPAUSE}" && isTrue "${ENABLE_AUTOSTOP}"; then
     logError "ENABLE_AUTOPAUSE=true is incompatible with ENABLE_AUTOSTOP=true"
     exit 1
@@ -322,7 +321,7 @@ case "${TYPE^^}" in
       logError "Invalid TYPE: '$TYPE'"
       logError "Must be: VANILLA, FORGE, BUKKIT, SPIGOT, PAPER, FOLIA, PURPUR, FABRIC, QUILT,"
       logError "         SPONGEVANILLA, CUSTOM, MAGMA, MOHIST, GTNH, AIRPLANE, PUFFERFISH,"
-      logError "         CANYON, LIMBO, NANOLIMBO, CRUCIBLE, LEAF, YOUER, BANNER"
+      logError "         CANYON, LIMBO, NANOLIMBO, CRUCIBLE, LEAF, YOUER, BANNER, NEOFORGE"
       exit 1
   ;;
 

scripts/start-finalExec

@@ -103,20 +103,79 @@ elif versionLessThan 1.18.1; then
   fi
 fi
 
-if isTrue "${ENABLE_ROLLING_LOGS:-false}"; then
-  if ! ${canUseRollingLogs}; then
-    logError "Using rolling logs is currently not possible in the selected version due to CVE-2021-44228"
-    exit 1
+# Set up log4j2 configuration with templating support
+if ${canUseRollingLogs}; then
+  # Set up log configuration defaults
+  : "${LOG_LEVEL:=info}"
+  : "${ROLLING_LOG_MAX_FILES:=1000}"
+  # Note: Can't use ${VAR:=default} syntax for values containing } as it breaks parsing
+  if [ -z "${ROLLING_LOG_FILE_PATTERN}" ]; then
+    ROLLING_LOG_FILE_PATTERN='logs/%d{yyyy-MM-dd}-%i.log.gz'
   fi
-  # Set up log configuration
+
+  # Pattern format defaults (compatible with vanilla Minecraft)
+  # Note: Can't use ${VAR:=default} syntax because } in the value breaks parsing
+  if [ -z "${LOG_CONSOLE_FORMAT}" ]; then
+    LOG_CONSOLE_FORMAT='[%d{HH:mm:ss}] [%t/%level]: %msg%n'
+  fi
+  if [ -z "${LOG_TERMINAL_FORMAT}" ]; then
+    LOG_TERMINAL_FORMAT='[%d{HH:mm:ss} %level]: %msg%n'
+  fi
+  if [ -z "${LOG_FILE_FORMAT}" ]; then
+    LOG_FILE_FORMAT='[%d{HH:mm:ss}] [%t/%level]: %msg%n'
+  fi
+
+  export LOG_LEVEL ROLLING_LOG_FILE_PATTERN ROLLING_LOG_MAX_FILES
+  export LOG_CONSOLE_FORMAT LOG_TERMINAL_FORMAT LOG_FILE_FORMAT
+
   LOGFILE="${SERVER_DIR}/log4j2.xml"
-  if [ ! -e "$LOGFILE" ]; then
-    log "Creating log4j2.xml in ${LOGFILE}"
-    cp /image/log4j2.xml "$LOGFILE"
+
+  # Always regenerate if file doesn't exist
+  if [ ! -e "$LOGFILE" ] || isTrue "${REGENERATE_LOG4J2:-true}"; then
+    log "Generating log4j2.xml from template in ${LOGFILE}"
+
+    # Generate log4j2.xml using heredoc for reliable variable substitution
+    cat > "$LOGFILE" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<Configuration status="WARN">
+    <Appenders>
+        <Console name="SysOut" target="SYSTEM_OUT">
+            <PatternLayout pattern="${LOG_CONSOLE_FORMAT}" />
+        </Console>
+        <Queue name="TerminalConsole">
+            <PatternLayout pattern="${LOG_TERMINAL_FORMAT}" />
+        </Queue>
+        <RollingRandomAccessFile name="File" fileName="logs/latest.log" filePattern="${ROLLING_LOG_FILE_PATTERN}">
+            <PatternLayout pattern="${LOG_FILE_FORMAT}" />
+            <Policies>
+                <TimeBasedTriggeringPolicy />
+                <OnStartupTriggeringPolicy />
+            </Policies>
+            <DefaultRolloverStrategy max="${ROLLING_LOG_MAX_FILES}"/>
+        </RollingRandomAccessFile>
+    </Appenders>
+    <Loggers>
+        <Root level="${LOG_LEVEL}">
+            <filters>
+                <MarkerFilter marker="NETWORK_PACKETS" onMatch="DENY" onMismatch="NEUTRAL" />
+            </filters>
+            <AppenderRef ref="SysOut"/>
+            <AppenderRef ref="File"/>
+            <AppenderRef ref="TerminalConsole"/>
+        </Root>
+    </Loggers>
+</Configuration>
+EOF
   else
-    log "log4j2.xml already created, skipping"
+    log "log4j2.xml already exists and is up to date, skipping generation"
   fi
+
+  # Apply the log4j2 configuration
   JVM_OPTS="-Dlog4j.configurationFile=log4j2.xml ${JVM_OPTS}"
+elif isTrue "${ENABLE_ROLLING_LOGS:-false}"; then
+  # Legacy behavior: error if rolling logs explicitly requested but not possible
+  logError "Using rolling logs is currently not possible in the selected version due to CVE-2021-44228"
+  exit 1
 fi
 
 # Optional disable console
@@ -485,16 +544,12 @@ fi
   if isTrue "${DEBUG_EXEC}"; then
     set -x
   fi
-  if isTrue "${EXEC_DIRECTLY:-false}"; then
-    "${finalArgs[@]}"
-  else
-    if [ -f "${FTB_DIR}/variables.txt" ]; then
-        JVM_ARGS="${JVM_XX_OPTS} ${JVM_OPTS} $expandedDOpts"
-        JVM_ARGS=${JVM_ARGS//$'\n'/}
-        sed -i "s~JAVA_ARGS=.*~JAVA_ARGS=\"${JVM_ARGS}\"~" "${FTB_DIR}/variables.txt"
-    fi
-    exec mc-server-runner "${mcServerRunnerArgs[@]}" "${finalArgs[@]}"
+  if [ -f "${FTB_DIR}/variables.txt" ]; then
+      JVM_ARGS="${JVM_XX_OPTS} ${JVM_OPTS} $expandedDOpts"
+      JVM_ARGS=${JVM_ARGS//$'\n'/}
+      sed -i "s~JAVA_ARGS=.*~JAVA_ARGS=\"${JVM_ARGS}\"~" "${FTB_DIR}/variables.txt"
   fi
+  exec mc-server-runner "${mcServerRunnerArgs[@]}" "${finalArgs[@]}"
 elif [[ $SERVER =~ run.sh ]]; then
   log "Using Forge supplied run.sh script..."
   echo $JVM_XX_OPTS $JVM_OPTS $expandedDOpts > user_jvm_args.txt
@@ -543,9 +598,5 @@ else
     set -x
   fi
 
-  if isTrue "${EXEC_DIRECTLY:-false}"; then
-    exec java "${finalArgs[@]}"
-  else
-    exec mc-server-runner ${bootstrapArgs} "${mcServerRunnerArgs[@]}" java "${finalArgs[@]}"
-  fi
+  exec mc-server-runner ${bootstrapArgs} "${mcServerRunnerArgs[@]}" java "${finalArgs[@]}"
 fi