Update dependency itzg/mc-image-helper to v1.64.1 (#4213)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/build.yml

@@ -30,10 +30,13 @@ jobs:
           - java25
           - java25-alpine
           - java25-jdk
+          - java25-graalvm
           - java21
           - java21-alpine
+          - java21-graalvm
           - java21-jdk
           - java17
+          - java17-graalvm
           - java16
           - java11
           - java8
@@ -46,8 +49,6 @@ jobs:
             baseImage: eclipse-temurin:25-jre-noble
             platforms: linux/amd64,linux/arm64,linux/riscv64
             mcVersion: latest
-            # forked build that include riscv64
-            knockdRepoOrg: Opvolger/knock
           - variant: java25-alpine
             baseImage: eclipse-temurin:25-jre-alpine
             platforms: linux/amd64,linux/arm64
@@ -56,6 +57,10 @@ jobs:
             baseImage: eclipse-temurin:25
             platforms: linux/amd64,linux/arm64
             mcVersion: latest
+          - variant: java25-graalvm
+            baseImage: container-registry.oracle.com/graalvm/jdk:25-ol10
+            platforms: linux/amd64,linux/arm64
+            mcVersion: latest
         # JAVA 21:
           - variant: java21
             baseImage: eclipse-temurin:21-jre
@@ -69,12 +74,20 @@ jobs:
             baseImage: eclipse-temurin:21-jre-alpine
             platforms: linux/amd64,linux/arm64
             mcVersion: 1.21.11
+          - variant: java21-graalvm
+            baseImage: container-registry.oracle.com/graalvm/jdk:21-ol10
+            platforms: linux/amd64,linux/arm64
+            mcVersion: 1.21.11
         # JAVA 17:
           - variant: java17
             # jammy doesn't work until minecraft updates to https://github.com/netty/netty/issues/12343
             baseImage: eclipse-temurin:17-jre-focal
             platforms: linux/amd64,linux/arm/v7,linux/arm64
             mcVersion: 1.20.4
+          - variant: java17-graalvm
+            baseImage: container-registry.oracle.com/graalvm/jdk:17-ol10
+            platforms: linux/amd64,linux/arm64
+            mcVersion: 1.20.4
         # JAVA 16
           - variant: java16
             baseImage: adoptopenjdk:16-jre-hotspot
@@ -106,6 +119,8 @@ jobs:
       # Assume they line up, but when forked change to your Docker Hub username
       DOCKER_HUB_ORG: ${{ github.repository_owner }}
       IMAGE_TO_TEST: "${{ github.repository_owner }}/minecraft-server:test-${{ matrix.variant }}-${{ github.run_id }}"
+      # NOTE: env values are always strings, so the boolean-valued ones below have to be
+      # compared with == 'true'. Used bare, the string "false" evaluates as true.
       HAS_IMAGE_REPO_ACCESS: ${{ secrets.DOCKER_USER != '' && secrets.DOCKER_PASSWORD != '' }}
       MAIN_VARIANT: java25
       PUSH: ${{ github.repository_owner == 'itzg' }}
@@ -180,15 +195,15 @@ jobs:
           tests/test.sh
 
       - name: Login to DockerHub
-        uses: docker/login-action@v4.4.0
-        if: env.HAS_IMAGE_REPO_ACCESS
+        uses: docker/login-action@v4.5.2
+        if: env.HAS_IMAGE_REPO_ACCESS == 'true'
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Login to GHCR
-        uses: docker/login-action@v4.4.0
-        if: env.HAS_IMAGE_REPO_ACCESS
+        uses: docker/login-action@v4.5.2
+        if: env.HAS_IMAGE_REPO_ACCESS == 'true'
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -201,13 +216,13 @@ jobs:
           platforms: ${{ matrix.platforms }}
           push: >
             ${{ 
-            env.PUSH &&
+            env.PUSH == 'true' &&
             (
               github.ref_type == 'tag' 
               || github.ref_name == github.event.repository.default_branch
               || startsWith(github.ref_name, 'test/')
               || ( github.event_name == 'pull_request' 
-                   && env.HAS_IMAGE_REPO_ACCESS 
+                   && env.HAS_IMAGE_REPO_ACCESS == 'true'
                    && contains(github.event.pull_request.labels.*.name, 'ci/push-image') 
                  )
             )

.github/workflows/stale-check.yml

@@ -13,7 +13,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Process Stale Issues
-        uses: actions/stale@v10
+        uses: actions/stale@v11
         with:
           stale-issue-label: status/stale
           stale-pr-label: status/stale

.github/workflows/verify-pr.yml

@@ -24,6 +24,7 @@ jobs:
         variant:
           - java25
           - java25-alpine
+          - java25-graalvm
           - java17
           - java8
         include:
@@ -39,6 +40,11 @@ jobs:
             mcVersion: latest
             # For GLIBC_2.34 support (and Alpine)
             knockdRepoOrg: Metalcape/knock
+          - variant: java25-graalvm
+            # stay aligned with build.yml
+            baseImage: container-registry.oracle.com/graalvm/jdk:25-ol10
+            platforms: linux/amd64,linux/arm64
+            mcVersion: latest
         # JAVA 17:
           - variant: java17
             # jammy doesn't work until minecraft updates to https://github.com/netty/netty/issues/12343
@@ -69,6 +75,9 @@ jobs:
       - name: Setup Docker Buildx
         uses: docker/setup-buildx-action@v4
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4.2.0
+
       - name: Confirm multi-arch build
         uses: docker/build-push-action@v7
         with:

Dockerfile

@@ -45,7 +45,7 @@ RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
 # renovate: datasource=github-releases packageName=itzg/mc-monitor
-ARG MC_MONITOR_VERSION=0.16.11
+ARG MC_MONITOR_VERSION=0.17.0
 RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --var version=${MC_MONITOR_VERSION} --var app=mc-monitor --file {{.app}} \
   --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
@@ -57,7 +57,7 @@ RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
 # renovate: datasource=github-releases packageName=itzg/mc-image-helper versioning=loose
-ARG MC_HELPER_VERSION=1.62.1
+ARG MC_HELPER_VERSION=1.64.1
 ARG MC_HELPER_BASE_URL=${GITHUB_BASEURL}/itzg/mc-image-helper/releases/download/${MC_HELPER_VERSION}
 # used for cache busting local copy of mc-image-helper
 ARG MC_HELPER_REV=1

README.md

@@ -6,9 +6,10 @@
 [![](https://img.shields.io/badge/Donate-Buy%20me%20a%20coffee-orange.svg)](https://www.buymeacoffee.com/itzg)
 [![Documentation Status](https://readthedocs.org/projects/docker-minecraft-server/badge/?version=latest)](https://docker-minecraft-server.readthedocs.io/en/latest/?badge=latest)
 
- [![Read the docs](docs/img/banner-docs.png)](https://docker-minecraft-server.readthedocs.io/)
+[![Read the docs](docs/img/banner-docs.png)](https://docker-minecraft-server.readthedocs.io/)
 
 There you will find things like
+
 - [Quick start with Docker Compose](https://docker-minecraft-server.readthedocs.io/en/latest/#using-docker-compose)
 - Running [different versions of Minecraft](https://docker-minecraft-server.readthedocs.io/en/latest/versions/minecraft/) and using [various server types](https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/) for Java Edition
 - [Setting server properties via container environment variables](https://docker-minecraft-server.readthedocs.io/en/latest/configuration/server-properties/)
@@ -36,6 +37,12 @@ This image only supports Java edition natively; however, if looking for a server
 
 <br clear="left" />
 
+<a href="https://seedloaf.com"><img src="https://seedloaf.com/images/logo.webp" alt="Seedloaf logo" width="48" align="left" /></a>
+
+<a href="https://seedloaf.com"><b>Seedloaf</b></a> - Built from scratch (by two nerds) on top of <code>itzg/minecraft-server</code>. Seedloaf offers free, and premium Minecraft servers where you have full control!
+
+<br clear="left" />
+
 <!-- additional sponsors repeat the pattern above: floated logo + blurb + clear-left break -->
 <!-- logo image preferrably hosted on an external, stable site at a size of 48x48px -->
 <!-- link to sponsor site -->

SECURITY.md

@@ -0,0 +1,39 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release or `latest` Docker tag receives security updates. If you discover a vulnerability, please test against the latest image version before reporting.
+
+## Automated Scans & Base Image Dependency Updates
+
+- **Automated Dependency Updates:** This repository utilizes automated background workflows to continuously upgrade base images, underlying dependencies, and the Go toolchain. Because CVE scanning tools flag vulnerabilities as soon as they are logged it is not practical to address them any faster than the automation is doing.
+- **Image Scan Reports & Triaging:** Please refrain from submitting raw scanner reports or screenshots (e.g., outputs from Trivy, Grype, or Docker Scout). CVEs in upstream base packages or system libraries are often constrained by upstream package maintainers. Submitting an issue or advisory for a scanner report does not accelerate a fix if the patch is not yet available in the upstream base image.
+- **Actionable PRs Welcome:** If a fix or patched package version **is** available upstream and has not yet been picked up by our automated build pipelines, submitting a pull request that updates the specific version pin or dependency is the best way to help speed up integration.
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
+
+To report a vulnerability privately:
+
+1. Navigate to the **[Security](https://github.com/itzg/docker-minecraft-server/security)** tab of this repository.
+2. Select **Report a vulnerability** to open a private security advisory.
+
+This allows us to review, reproduce, and resolve the issue in a private environment before public disclosure.
+
+---
+
+## Important Expectations & Bug Bounties
+
+* **No Financial Bounties:** This is an open-source, community-maintained project. We **do not** offer financial rewards, gift cards, or monetary bounties for vulnerability reports.
+* **Non-Critical & Automated Findings:** Reports generated purely by automated scanners (such as generic HTTP headers, low-severity container base image updates, or standard configuration warnings) without a working, practical proof-of-concept specific to this container will generally be closed.
+
+---
+
+## Dependency Upgrades & Pull Requests
+
+We welcome and appreciate community contributions! 
+
+If you identify an outdated or vulnerable upstream dependency (such as base packages, utilities, or underlying binaries), **we strongly encourage you to submit a Pull Request directly**. 
+
+Community-contributed PRs targeting dependency patches are the fastest way to get updates validated, built, and merged into the main release.

build/alpine/install-packages.sh

@@ -3,6 +3,13 @@
 set -e
 set -o pipefail
 
+# Patched knockd is only available for amd64 on Alpine, so install the package for other architectures
+knockPkg=""
+if [ "$TARGETARCH" != amd64 ]; then
+  knockPkg="knock"
+  echo "Installing knock package for $TARGETARCH architecture"
+fi
+
 # Install necessary packages
 # shellcheck disable=SC2086
 apk add --no-cache -U \
@@ -36,13 +43,18 @@ apk add --no-cache -U \
     numactl \
     jattach \
     gcompat \
+    "$knockPkg" \
     ${EXTRA_ALPINE_PACKAGES}
 
-# Download and install patched knockd
-curl -fsSL -o /tmp/knock.tar.gz "https://github.com/${KNOCKD_REPO_ORG}/releases/download/${KNOCKD_VERSION}/knock-${KNOCKD_VERSION}-alpine-amd64.tar.gz"
-tar -xf /tmp/knock.tar.gz -C /usr/local/ && rm /tmp/knock.tar.gz
-ln -s /usr/local/sbin/knockd /usr/sbin/knockd
-setcap cap_net_raw=ep /usr/local/sbin/knockd
+if ! [ "$knockPkg" ]; then
+  # Download and install patched knockd
+  knockdUrl="https://github.com/${KNOCKD_REPO_ORG}/releases/download/${KNOCKD_VERSION}/knock-${KNOCKD_VERSION}-alpine-amd64.tar.gz"
+  echo "Downloading knockd from $knockdUrl"
+  curl -fsSL -o /tmp/knock.tar.gz "$knockdUrl"
+  tar -xf /tmp/knock.tar.gz -C /usr/local/ && rm /tmp/knock.tar.gz
+  ln -s /usr/local/sbin/knockd /usr/sbin/knockd
+  setcap cap_net_raw=ep /usr/local/sbin/knockd
+fi
 
 # Set Git credentials globally
 cat <<EOF >> /etc/gitconfig

build/ol/install-packages.sh

@@ -66,16 +66,12 @@ fi
 # Clean up DNF when done
 dnf clean all
 
-cat <<EOF > /usr/local/sbin/knockd
-#!/bin/sh
-
-echo "Auto-pause (using knockd) is currently unavailable on graalvm image variants"
-echo "Consider using a different image variant https://docker-minecraft-server.readthedocs.io/en/latest/versions/java/"
-echo "or mc-router's auto scale up/down feature https://github.com/itzg/mc-router#docker-auto-scale-updown"
-exit 2
-EOF
-chmod 755 /usr/local/sbin/knockd
-# TODO restore retrieval from https://github.com/Metalcape/knock when tar's "Cannot open: Invalid argument" is solved
+# Download and install patched knockd
+curl -fsSL -o /tmp/knock.tar.gz https://github.com/Metalcape/knock/releases/download/0.8.1/knock-0.8.1-$TARGET.tar.gz
+tar -xf /tmp/knock.tar.gz -C /usr/local/ && rm /tmp/knock.tar.gz
+ln -s /usr/local/sbin/knockd /usr/sbin/knockd
+ls -l /usr/local/sbin/knockd
+setcap cap_net_raw=ep /usr/local/sbin/knockd
 
 # Set git credentials globally
 cat <<EOF >> /etc/gitconfig

build/ol/setup-user.sh

@@ -1,2 +1,6 @@
+#!/bin/sh
+
+set -e
+
 groupadd --gid 1000 minecraft
 useradd --system --shell /bin/false --uid 1000 -g minecraft --home /data minecraft

build/ubuntu/install-packages.sh

@@ -37,8 +37,13 @@ apt-get install -y \
 # Clean up APT when done
 apt-get clean
 
+if [ "$TARGETARCH" = riscv64 ]; then
+  KNOCKD_REPO_ORG=Opvolger/knock
+fi
 # Download and install patched knockd
-curl -fsSL -o /tmp/knock.tar.gz "https://github.com/${KNOCKD_REPO_ORG}/releases/download/${KNOCKD_VERSION}/knock-${KNOCKD_VERSION}-$TARGET.tar.gz"
+knockdUrl="https://github.com/${KNOCKD_REPO_ORG}/releases/download/${KNOCKD_VERSION}/knock-${KNOCKD_VERSION}-$TARGET.tar.gz"
+echo "Downloading knockd from $knockdUrl"
+curl -fsSL -o /tmp/knock.tar.gz "$knockdUrl"
 tar -xf /tmp/knock.tar.gz -C /usr/local/ && rm /tmp/knock.tar.gz
 ln -s /usr/local/sbin/knockd /usr/sbin/knockd
 setcap cap_net_raw=ep /usr/local/sbin/knockd

docs/requirements.txt

@@ -14,7 +14,7 @@ mkdocstrings==1.0.6
 mkdocstrings-python==2.0.5
 packaging==26.2
 pathspec==1.1.1
-platformdirs==4.10.0
+platformdirs==4.11.0
 Pygments==2.20.0
 pymdown-extensions==11.0.1
 python-dateutil==2.9.0.post0
@@ -22,4 +22,4 @@ PyYAML==6.0.3
 pyyaml_env_tag==1.1
 six==1.17.0
 watchdog==6.0.0
-zensical==0.0.50
+zensical==0.0.51

docs/types-and-platforms/mod-platforms/gtnh.md

@@ -12,7 +12,7 @@ Configuration options with defaults:
 
 ## Set Modpack version
 
-As GTNH is a Minecraft 1.7.10 modpack, when using it your minecraft version is set to 1.7.10 by default. The [modpack version](https://www.gtnewhorizons.com/downloads/) can be selected by setting `GTNH_PACK_VERSION` to `latest`, `latest-dev` or any specific version number. `latest` will automatically select the latest full release version available and deploy the server with it (Note: this will also automatically update the server on startup). `latest-dev` does the same but selects the latest version marked as beta or RC (it won't select a full release version even if a newer exist). The third (and recommended) option is setting the server to a specific version like `2.8.1` to manage updates manually.
+As GTNH is a Minecraft 1.7.10 modpack, when using it your minecraft version is set to 1.7.10 by default. The [modpack version](https://www.gtnewhorizons.com/downloads/) can be selected by setting `GTNH_PACK_VERSION` to `latest`, `latest-beta` (formerly `latest-dev`) or any specific version number. `latest` will automatically select the latest full release version available and deploy the server with it (Note: this will also automatically update the server on startup). `latest-beta` does the same but selects the latest version marked as beta or RC (it won't select a full release version even if a newer exist). The third (and recommended) option is setting the server to a specific version like `2.8.1` to manage updates manually.
 
 > To actively prevent an update from happening you can set the environment variable `SKIP_GTNH_UPDATE_CHECK` to true this will prevent any update check from running, but will also prevent the server install from running, so just set it after the initial setup.
 
@@ -52,3 +52,11 @@ To deliver the intended GTNH by default, when running a GTNH server, the followi
 With java 17+ the server starts with `-Dfml.readTimeout=180 @java9args.txt -jar lwjgl3ify-forgePatches.jar`. 
 
 With java 8 the server stars with `-XX:+UseStringDeduplication -XX:+UseCompressedOops -XX:+UseCodeCacheFlushing -Dfml.readTimeout=180 -jar forge-1.7.10-10.13.4.1614-1.7.10-universal.jar`
+
+## Developer Versions
+
+To run the nightly developer builds of GTNH, set the environment variable `GTNH_USE_DAILY_BUILD` to true and set `GTNH_PACK_VERSION` either to `latest` or a specific run ID of the build workflow. The run ID can be found in the [GTNH GitHub Actions](https://github.com/GTNewHorizons/DreamAssemblerXXL/actions) page of the DreamAssemblerXXL repository. The run ID is the number in the URL of the workflow run, for example `123456789`. 
+
+Since downloads require authentication, you will also need to set the environment variable `GH_TOKEN` to a valid GitHub Personal Access Token with `public_repo` scope. You can create a token in your [GitHub settings](https://github.com/settings/tokens) page. Be sure to keep your token secret and do not share it with anyone. The token is only used to download the developer builds and is not stored anywhere in the server (except in the environment variables). 
+
+Keep in mind that developer builds are not stable and may contain bugs or incomplete features. Use them at your own risk. It is recommended to use the latest stable release for production servers!

docs/versions/java.md

@@ -17,10 +17,13 @@ where `<tag>` refers to the first column of this table:
 | java25        | 25           | Ubuntu | Hotspot     | amd64, arm64, riscv64 |      |
 | java25-alpine | 25           | Alpine | Hotspot     | amd64, arm64          |      |
 | java25-jdk    | 25           | Ubuntu | Hotspot+JDK | amd64, arm64          |      |
+| java25-graalvm | 25          | Oracle | Oracle GraalVM | amd64, arm64       | (2)(3) |
 | java21        | 21           | Ubuntu | Hotspot     | amd64, arm64          |      |
 | java21-jdk    | 21           | Ubuntu | Hotspot+JDK | amd64, arm64          |      |
 | java21-alpine | 21           | Alpine | Hotspot     | amd64, arm64          |      |
+| java21-graalvm | 21          | Oracle | Oracle GraalVM | amd64, arm64       | (2)(3) |
 | java17        | 17           | Ubuntu | Hotspot     | amd64, arm64, armv7   |      |
+| java17-graalvm | 17          | Oracle | Oracle GraalVM | amd64, arm64       | (2)(3) |
 | java16        | 16           | Ubuntu | Hotspot     | amd64, arm64, armv7   | (1)  |
 | java11        | 11           | Ubuntu | Hotspot     | amd64, arm64, armv7   |      |
 | java8         | 8            | Ubuntu | Hotspot     | amd64, arm64, armv7   |      |
@@ -28,6 +31,8 @@ where `<tag>` refers to the first column of this table:
 Notes
 
 1. This version of Java is [recommended for PaperMC 1.16.5](https://docs.papermc.io/paper/getting-started/#requirements)
+2. Based on the [Oracle GraalVM images](https://blogs.oracle.com/java/post/new-oracle-graalvm-container-images), which as of JDK 17, are now under the [GraalVM Free License](https://blogs.oracle.com/java/post/graalvm-free-license) incorporating what used to be known as the GraalVM Enterprise.
+3. Due to these images using Oracle Linux, (which is based on Red Hat Enterprise Linux) Forge Installer will not work due to its use of zlib-ng. Use other images for initial installation and Forge version upgrade.
 
 !!! example "Example using java8"
 
@@ -121,7 +126,6 @@ Forge also doesn't support openj9 JVM implementation.
 
 The following image tags have been deprecated and are no longer receiving updates:
 
-- java25-graalvm, java21-graalvm, java17-graalvm
 - adopt13
 - adopt14
 - adopt15

examples/gtnh/docker-compose-type-gtnh.yaml

@@ -14,6 +14,9 @@ services:
       # GTNH_DELETE_BACKUPS: true
       # Use to prevent updates
       # SKIP_GTNH_UPDATE_CHECK: true
+      # Enable and set Token for daily builds
+      # GTNH_USE_DAILY_BUILD: true
+      # GH_TOKEN: mytoken
       MEMORY: 6G
       # Bring in standard extra mods described at https://wiki.gtnewhorizons.com/wiki/Additional_Mods
 #      MODS: |

files/nanolimbo-settings-patch.json

@@ -1,12 +1,16 @@
 {
-  "file": "/data/settings.yml",
-  "ops": [
+  "patches": [
     {
-      "$set": {
-        "path": "$.bind.port",
-        "value": "${SERVER_PORT}",
-        "value-type": "int"
-      }
+      "file": "/data/settings.yml",
+      "ops": [
+        {
+          "$set": {
+            "path": "$.bind.port",
+            "value": "${SERVER_PORT}",
+            "value-type": "int"
+          }
+        }
+      ]
     }
   ]
-}
+}

scripts/auto/autopause-daemon.sh

@@ -40,7 +40,7 @@ if ! mc-image-helper network-interfaces --check="$AUTOPAUSE_KNOCK_INTERFACE" ; t
   autopause_error_loop
 fi
 
-knockdArgs=(-c /tmp/knockd-config.cfg -d -i "$AUTOPAUSE_KNOCK_INTERFACE")
+knockdArgs=(-c /data/.knockd.cfg -d -i "$AUTOPAUSE_KNOCK_INTERFACE")
 if isTrue "${DEBUG_AUTOPAUSE}"; then
   knockdArgs+=(-D)
 fi

scripts/start-autopause

@@ -24,13 +24,13 @@ log "Autopause functionality enabled"
 
 isDebugging && set -x
 
-cp /image/knockd-config.cfg /tmp/knockd-config.cfg
+cp /image/knockd-config.cfg /data/.knockd.cfg
 
 function updatePort() {
   regseq="^\s*sequence\s*=\s*$1\s*$"
-  linenum=$(grep -nm${2} sequence /tmp/knockd-config.cfg | cut -d : -f 1 | tail -n1)
-  if ! [[ $(awk "NR==$linenum" /tmp/knockd-config.cfg) =~ $regseq ]]; then
-    sed -i "${linenum}s/sequence.*/sequence = $1/" /tmp/knockd-config.cfg
+  linenum=$(grep -nm${2} sequence /data/.knockd.cfg | cut -d : -f 1 | tail -n1)
+  if ! [[ $(awk "NR==$linenum" /data/.knockd.cfg) =~ $regseq ]]; then
+    sed -i "${linenum}s/sequence.*/sequence = $1/" /data/.knockd.cfg
     log "Updated $3 port in knockd config"
   fi
 }
@@ -67,6 +67,12 @@ fi
 # seq_cooldown cannot be larger than AUTOPAUSE_TIMEOUT_KN, otherwise the server may
 # become paused while knockd is still ignoring packets, preventing players from joining.
 let COOLDOWN=$AUTOPAUSE_TIMEOUT_KN/2
-sed -i "s/\(seq_cooldown *= *\).*/\1$COOLDOWN/" /tmp/knockd-config.cfg
+sed -i "s/\(seq_cooldown *= *\).*/\1$COOLDOWN/" /data/.knockd.cfg
+
+if isDebugging; then
+  echo "Autopause configuration: ======================================"
+  cat /data/.knockd.cfg
+  echo "==============================================================="
+fi
 
 "$(dirname "$0")/auto/autopause-daemon.sh" &

scripts/start-deployGTNH

@@ -7,11 +7,13 @@
 function getGTNHdownloadPath(){
   gtnh_download_path=""
   local release_object=""
-  local current_java_version=""
-  current_java_version=$(mc-image-helper java-release)
 
   # Select release JSON object
-  if [ "$GTNH_PACK_VERSION" == "latest-dev" ]; then
+  # latest-dev will be removed in the future, but is still supported for now.
+  if [ "$GTNH_PACK_VERSION" == "latest-dev" ] || [ "$GTNH_PACK_VERSION" == "latest-beta" ]; then
+    if [ "$GTNH_PACK_VERSION" == "latest-dev" ]; then
+      logWarning "GTNH_PACK_VERSION=latest-dev is deprecated and will be removed in the future."
+    fi
     if ! release_object="$(
       curl -fsSL "https://downloads.gtnewhorizons.com/versions.json" \
         | jq -r '(.versions // .)|to_entries|sort_by(.value.releaseDate)|map(select(.value.title=="Beta release"))|.[-1]'
@@ -46,23 +48,18 @@ function getGTNHdownloadPath(){
   fi
   
   # Select compatible server files for java version
-  if (( current_java_version == 8 )); then
+  if (( java_version == 8 )); then
     gtnh_download_path=$(jq -r '.value.server.java8Url' <<< "$release_object")
     log "Use GTNH Server Java 8 release."
   
-  elif (( current_java_version >= 17 )); then
-    if (( current_java_version > $(jq '.value.maxJavaVersion' <<< "$release_object") )); then
-      logError "Container Java version $current_java_version is not supported by GTNH. Try an older release."
+  elif (( java_version >= 17 )); then
+    if (( java_version > $(jq '.value.maxJavaVersion' <<< "$release_object") )); then
+      logError "Container Java version $java_version is not supported by GTNH. Try an older release."
       exit 1
     fi
   
     gtnh_download_path=$(jq -r '.value.server.java17_2XUrl' <<< "$release_object")
     log "Use GTNH Server Java 17+ release."
-  
-  else
-    logError "Container Java version $current_java_version is not supported by GTNH."
-    exit 1
-  
   fi
   
   if [[ -z $gtnh_download_path ]]; then
@@ -73,6 +70,56 @@ function getGTNHdownloadPath(){
 
 }
 
+function getGTNHdownloadOptions(){
+  # Used for GTNH daily build downloads, to pass additional options to the download command.
+  gtnh_download_options=()
+  # Used for dryrun check
+  gtnh_download_path=""
+
+  # Check if GH_TOKEN is set for daily builds
+  if [ -z "$GH_TOKEN" ]; then
+    logError "GH_TOKEN environment variable must be set to use daily builds."
+    exit 1
+  fi
+
+  gtnh_download_options+=( --output-filename )
+
+  # prepare download options as an array to safely append patterns
+  if [ "$GTNH_PACK_VERSION" == "latest" ] || [ "$GTNH_PACK_VERSION" == "latest-dev" ]; then
+    if [ "$GTNH_PACK_VERSION" == "latest-dev" ]; then
+      logWarning "GTNH_PACK_VERSION=latest-dev is deprecated and will be removed in the future."
+    fi
+    gtnh_download_options+=( --workflow=daily-modpack-build.yml )
+    log "Using latest daily build for GTNH server files."
+  elif [ "$GTNH_PACK_VERSION" == "latest-beta" ]; then
+    gtnh_download_options+=( --workflow=daily-modpack-build.yml )
+    logWarning "Using daily build instead of latest beta release for GTNH server files. If this is not intended, set GTNH_USE_DAILY_BUILD=false to use the latest beta release instead."
+  else
+    gtnh_download_options+=( --run-id="$GTNH_PACK_VERSION" )
+    log "Using specific daily build run ID $GTNH_PACK_VERSION for GTNH server files."
+  fi
+
+  # Select compatible server files for java version
+  if (( java_version == 8 )); then
+    log "Use GTNH Server Java 8 release."
+    gtnh_download_options+=( --artifact-pattern='GTNH-daily-\d{4}-\d{2}-\d{2}\+\d+-server-java8\.zip' )
+  
+  elif (( java_version >= 17 )); then
+    log "Use GTNH Server Java 17+ release."
+    gtnh_download_options+=( --artifact-pattern='GTNH-daily-\d{4}-\d{2}-\d{2}\+\d+-server-java17-\d{2}\.zip' )
+  fi
+
+  debug "GTNH daily build download options: ${gtnh_download_options[*]}"
+
+  if ! gtnh_download_path=$(mc-image-helper github download-artifact --no-download "${gtnh_download_options[@]}" GTNewHorizons/DreamAssemblerXXL); then
+    logError "Failed to find a matching daily build for GTNH server files with the specified options."
+    exit 1
+  fi
+
+  debug "GTNH daily build download path: $gtnh_download_path"
+  
+}
+
 function deleteGTNHbackup(){
   log "Start deleting all config backups"
   if ! find . -maxdepth 1 -type d -name 'gtnh-upgrade-*' -exec rm -rf {} + ; then
@@ -81,24 +128,33 @@ function deleteGTNHbackup(){
 }
 
 function downloadGTNH(){
-  local gtnh_download=""
+  gtnh_download=""
   base_dir=/data/.tmp/gtnh_base
 
   debug "Creating temporary /data/.tmp/packs folder for GTNH download"
   mkdir -p /data/.tmp/packs
   trap 'rm -rf /data/.tmp' EXIT
-  
-  log "Downloading $gtnh_download_path."
-  if ! gtnh_download=$(mc-image-helper get -o /data/.tmp/packs --output-filename --skip-up-to-date "$gtnh_download_path"); then
-    logError "Failed to download $gtnh_download_path"
-    exit 1
-  fi
-  debug "Downloaded GTNH server files to $gtnh_download"
-
-  # Unpacking Server files into temporary directory
-  log "Unpacking Server Files into $base_dir"
   mkdir -p "${base_dir}"
-  extract "${gtnh_download}" "${base_dir}"
+  
+  if isTrue "$GTNH_USE_DAILY_BUILD"; then
+  log "Downloading Daily Build for GTNH server files."
+    # gtnh_download_options is injecting download parameters -> (--workflow or --run-id) and --artifact-pattern
+    if ! gtnh_download=$(mc-image-helper github download-artifact -o=$base_dir --unzip "${gtnh_download_options[@]}" GTNewHorizons/DreamAssemblerXXL); then
+      logError "Failed to download Daily Build for GTNH server files."
+      exit 1
+    fi
+  else 
+    log "Downloading $gtnh_download_path."
+    if ! gtnh_download=$(mc-image-helper get -o /data/.tmp/packs --output-filename --skip-up-to-date "$gtnh_download_path"); then
+      logError "Failed to download $gtnh_download_path"
+      exit 1
+    fi
+    debug "Downloaded GTNH server files to $gtnh_download"
+
+    # Unpacking Server files into temporary directory
+    log "Unpacking Server Files into $base_dir"
+    extract "${gtnh_download}" "${base_dir}"
+  fi
 
   # Remove any eula file since container manages it
   debug "Removing eula.txt from $base_dir"
@@ -209,16 +265,23 @@ function handleGTNH() {
   : "${GTNH_PACK_VERSION:=latest}"
   : "${GTNH_DELETE_BACKUPS:=false}"
   : "${SKIP_GTNH_UPDATE_CHECK:=false}"
-  debug "GTNH VAR CHECK: GTNH_DELETE_BACKUPS=$GTNH_DELETE_BACKUPS, GTNH_PACK_VERSION=$GTNH_PACK_VERSION, TYPE=$TYPE, SKIP_GTNH_UPDATE_CHECK=$SKIP_GTNH_UPDATE_CHECK"
+  : "${GTNH_USE_DAILY_BUILD:=false}"
+  
+  debug "GTNH VAR CHECK: GTNH_DELETE_BACKUPS=$GTNH_DELETE_BACKUPS, GTNH_PACK_VERSION=$GTNH_PACK_VERSION,  TYPE=$TYPE, SKIP_GTNH_UPDATE_CHECK=$SKIP_GTNH_UPDATE_CHECK, GTNH_USE_DAILY_BUILD=$GTNH_USE_DAILY_BUILD"
 
   if isTrue "$GTNH_DELETE_BACKUPS"; then
     deleteGTNHbackup
   fi
 
-  if [[ -n "$GTNH_PACK_VERSION" ]] && isFalse "$SKIP_GTNH_UPDATE_CHECK" ; then
+  if [[ -n "$GTNH_PACK_VERSION" ]] && isFalse "$SKIP_GTNH_UPDATE_CHECK"; then
     
-    getGTNHdownloadPath
-    log "Server files located! Will proceed update $gtnh_download_path."
+    if isFalse "$GTNH_USE_DAILY_BUILD"; then
+      getGTNHdownloadPath
+      log "Server files located! Will proceed update $gtnh_download_path."
+    else
+      getGTNHdownloadOptions
+      log "Will proceed update with daily build options: ${gtnh_download_options[*]}."
+    fi
 
 
     # Decide if update or install is needed or not.
@@ -239,7 +302,7 @@ function handleGTNH() {
       fi
 
       # Update .gtnh-version
-      basename "$gtnh_download_path" > /data/.gtnh-version
+      basename "$gtnh_download" > /data/.gtnh-version
 
       # Cleaning up temporary files
       rm -rf /data/.tmp

scripts/start-deployNanoLimbo

@@ -158,10 +158,10 @@ traffic:
   # Ignored if -1.0
   maxPacketBytesRate: 2048.0
 EOF
+else
+  mc-image-helper patch --patch-env-prefix "" /image/nanolimbo-settings-patch.json
 fi
 
-mc-image-helper patch --patch-env-prefix "" /image/nanolimbo-settings-patch.json
-
 export SERVER
 export FAMILY=LIMBO
 

scripts/start-finalExec

@@ -213,8 +213,11 @@ fi
 : "${USE_MEOWICE_FLAGS:=false}"
 : "${USE_MEOWICE_GRAALVM_FLAGS:=false}"
 
-if isTrue "${USE_MEOWICE_FLAGS}"; then
+if isTrue "${USE_MEOWICE_FLAGS}" || isTrue "${USE_MEOWICE_GRAALVM_FLAGS}"; then
   java_major_version=$(mc-image-helper java-release)
+fi
+
+if isTrue "${USE_MEOWICE_FLAGS}"; then
   if [[ $java_major_version -gt 16 ]]; then
     log "Java version $java_major_version using MeowIce's flags for Java 17+"
   else
@@ -344,6 +347,11 @@ if isTrue "${USE_MEOWICE_FLAGS}"; then
   else
     log "cpu not x86_64, disabling architecture specific flags"
   fi
+  if [[ $java_major_version -gt 23 ]]; then
+    JVM_XX_OPTS="${JVM_XX_OPTS}
+    -XX:+UseCompactObjectHeaders
+    "
+  fi
 fi
 
 if isTrue "${USE_MEOWICE_GRAALVM_FLAGS}"; then

scripts/start-setupModpack

@@ -15,7 +15,6 @@ set -e -o pipefail
 
 # shellcheck source=start-utils
 . "$(dirname "$0")/start-utils"
-isDebugging && set -x
 
 if [[ -n ${CF_API_KEY_FILE} ]]; then
   if [[ -r "${CF_API_KEY_FILE}" ]]; then
@@ -27,6 +26,8 @@ if [[ -n ${CF_API_KEY_FILE} ]]; then
   fi
 fi
 
+isDebugging && set -x
+
 sum_file=/data/.generic_pack.sum
 # Remove old mods/plugins
 if isTrue "${REMOVE_OLD_MODS}" && [ -z "${MODS_FILE}" ]; then

tests/setuponlytests/nanolimbo-existing-settings/docker-compose.yml

@@ -0,0 +1,23 @@
+services:
+  # copies seed/ into /data before mc starts, so the NanoLimbo setup takes its
+  # "settings.yml already exists" path instead of writing the template
+  seed:
+    restart: "no"
+    image: ${IMAGE_TO_TEST:-itzg/minecraft-server}
+    entrypoint: ["bash", "-c", "cp /seed/settings.yml /data/ && chown -R 1000:1000 /data"]
+    volumes:
+      - ./seed:/seed
+      - ./data:/data
+
+  mc:
+    restart: "no"
+    image: ${IMAGE_TO_TEST:-itzg/minecraft-server}
+    depends_on:
+      seed:
+        condition: service_completed_successfully
+    environment:
+      EULA: "TRUE"
+      TYPE: NANOLIMBO
+      SERVER_PORT: "25599"
+    volumes:
+      - ./data:/data

tests/setuponlytests/nanolimbo-existing-settings/seed/settings.yml

@@ -0,0 +1,4 @@
+bind:
+  ip: '0.0.0.0'
+  port: 25565
+maxPlayers: 100

tests/setuponlytests/nanolimbo-existing-settings/verify.sh

@@ -0,0 +1,4 @@
+set -e
+# SERVER_PORT must have been applied to the settings.yml that was already there
+port=$(mc-image-helper yaml-path --file /data/settings.yml .bind.port)
+[ "$port" = 25599 ] || { echo "expected bind.port 25599 but was '$port'"; exit 1; }