Add PRE_START_SCRIPT, run after setup and before the server starts (#4293)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/build.yml

@@ -166,7 +166,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.2.0
+        uses: docker/setup-qemu-action@v4.4.0
 
       - name: Build for test
         uses: docker/build-push-action@v7

.github/workflows/discord.yml

@@ -1,43 +0,0 @@
-name: Discord notifications
-
-on:
-  release:
-    types:
-      - published
-  workflow_run:
-    workflows: ["Build and Publish"]
-    types:
-      - completed
-
-env:
-  DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-
-jobs:
-  discord:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    if: github.repository_owner == 'itzg'
-    steps:
-      - name: on-publish
-        if: github.event_name == 'release' && github.event.action == 'published'
-        uses: SethCohen/github-releases-to-discord@v1.20.0
-        with:
-          webhook_url: ${{ secrets.DISCORD_WEBHOOK }}
-      - name: on-success
-        if: github.event.workflow_run.conclusion == 'success'
-        uses: Ilshidur/action-discord@master
-        with:
-          args: |
-            Github repo: ${{ github.repository }}
-            - Branch: ${{ github.event.workflow_run.head_branch }}
-            - [Link: to Actions](<${{ github.event.workflow_run.html_url }}>)
-            - Status: 🎉  ${{ github.event.workflow_run.conclusion }}  🍏
-      - name: on-failure
-        if: github.event.workflow_run.conclusion == 'failure'
-        uses: Ilshidur/action-discord@master
-        with:
-          args: |
-            Github repo: ${{ github.repository }}
-            - Branch: ${{ github.event.workflow_run.head_branch }}
-            - [Link: to Actions](<${{ github.event.workflow_run.html_url }}>)
-            - Status: 🤔  ${{ github.event.workflow_run.conclusion }}  💣💥

.github/workflows/verify-pr.yml

@@ -76,7 +76,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.2.0
+        uses: docker/setup-qemu-action@v4.4.0
 
       - name: Confirm multi-arch build
         uses: docker/build-push-action@v7

Dockerfile

@@ -17,7 +17,7 @@ ARG KNOCKD_REPO_ORG=Metalcape/knock
 RUN --mount=target=/build,source=build \
     TARGET=${TARGETARCH}${TARGETVARIANT} \
     /build/run.sh install-packages
-COPY --from=tianon/gosu /gosu /usr/local/bin/
+COPY --from=tianon/gosu:1.19 /gosu /usr/local/bin/
 
 RUN --mount=target=/build,source=build \
     /build/run.sh setup-user
@@ -45,19 +45,19 @@ RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
 # renovate: datasource=github-releases packageName=itzg/mc-monitor
-ARG MC_MONITOR_VERSION=0.17.1
+ARG MC_MONITOR_VERSION=0.18.1
 RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --var version=${MC_MONITOR_VERSION} --var app=mc-monitor --file {{.app}} \
   --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
 # renovate: datasource=github-releases packageName=itzg/mc-server-runner
-ARG MC_SERVER_RUNNER_VERSION=1.15.1
+ARG MC_SERVER_RUNNER_VERSION=1.16.0
 RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --var version=${MC_SERVER_RUNNER_VERSION} --var app=mc-server-runner --file {{.app}} \
   --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
 # renovate: datasource=github-releases packageName=itzg/mc-image-helper versioning=loose
-ARG MC_HELPER_VERSION=1.66.1
+ARG MC_HELPER_VERSION=1.70.0
 ARG MC_HELPER_BASE_URL=${GITHUB_BASEURL}/itzg/mc-image-helper/releases/download/${MC_HELPER_VERSION}
 # used for cache busting local copy of mc-image-helper
 ARG MC_HELPER_REV=1

docs/configuration/misc-options.md

@@ -209,6 +209,22 @@ By default, the image finishes startup by exec'ing [mc-server-runner](https://gi
 > [!TIP]
 > The `SERVER_RUNNER` variable is expanded when passed to `exec` so that `mc-server-runner` can be wrapped by another executable that is mounted into the container.
 
+## Pre-start script
+
+To run something of your own after the image has finished setting up the server files and just before it starts the server, set `PRE_START_SCRIPT` to the path of an executable file that you have mounted into the container. The image runs it directly (not through a shell) and waits for it to finish. It runs as the user the server runs as, from the server's working directory, with the same environment the server gets. If it exits with a non-zero status, the container exits without starting the server.
+
+For example, a script that waits for plugin jars that another process is still downloading:
+
+```yaml
+    environment:
+      PRE_START_SCRIPT: /hooks/wait-for-plugins
+    volumes:
+      - ./hooks:/hooks:ro
+```
+
+> [!WARNING]
+> The image does not guarantee that any particular command is available to the script, and it may change between image versions. Keeping the script working is up to you.
+
 ## Enable Flare Flags
     
 To enable the JVM flags required to fully support the [Flare profiling suite](https://blog.airplane.gg/flare), set the following variable:

docs/mods-and-plugins/curseforge-files.md

@@ -6,7 +6,7 @@ A specific file can be omitted from each reference to allow for auto-selecting t
 
 !!! info "CurseForge API key usage"
 
-    A CurseForge API key is _now_ included by this image; however, you can always supply your own instead. A CurseForge API key can be allocated and set with `CF_API_KEY` (or `CF_API_KEY_FILE`) [as described here](../types-and-platforms/mod-platforms/auto-curseforge.md#api-key).
+    A CurseForge API key is _now_ included by this image on Java 17 and newer; however, you can always supply your own instead. A CurseForge API key can be allocated and set with `CF_API_KEY` (or `CF_API_KEY_FILE`) [as described here](../types-and-platforms/mod-platforms/auto-curseforge.md#api-key). The `java8` image (and other pre-Java 17 tags) does not include a baked-in key; set `CF_API_KEY` yourself.
 
 ## Project-file references
 

docs/mods-and-plugins/index.md

@@ -66,6 +66,8 @@ You can also specify the `REMOVE_OLD_MODS_DEPTH` (default is 16) variable to onl
 
 For example: `-e REMOVE_OLD_MODS=TRUE -e REMOVE_OLD_MODS_INCLUDE="*.jar" -e REMOVE_OLD_MODS_DEPTH=1` will remove all old jar files that are directly inside the `plugins/` or `mods/` directory.
 
+To remove all files in the `/data/config` directory before a modpack is downloaded and unpacked, set `REMOVE_OLD_CONFIGS=TRUE`. This is useful when a modpack update would otherwise override locally customized configuration files. The removal process can be fine tuned with `REMOVE_OLD_CONFIGS_INCLUDE` and `REMOVE_OLD_CONFIGS_EXCLUDE` (comma separated lists of file glob patterns, defaults to `*` so everything is removed) and `REMOVE_OLD_CONFIGS_DEPTH` (default 16). The target directory can be changed with `CONFIG_OUT_DIR` (default `/data/config`).
+
 These paths work well if you want to have a common set of modules in a separate location, but still have multiple worlds with different server requirements in either persistent volumes or a downloadable archive.
 
 !!! information "Multiple source directories"

docs/requirements.txt

@@ -1,8 +1,8 @@
-click==8.4.2
+click==8.5.0
 colorama==0.4.6
-deepmerge==2.1.0
+deepmerge==3.0.1
 ghp-import==2.1.0
-griffe==2.1.0
+griffe==2.3.0
 Jinja2==3.1.6
 Markdown==3.10.3
 MarkupSafe==3.0.3
@@ -11,15 +11,15 @@ mkdocs==1.6.1
 mkdocs-autorefs==1.4.4
 mkdocs-get-deps==0.2.2
 mkdocstrings==1.0.6
-mkdocstrings-python==2.0.5
+mkdocstrings-python==2.0.8
 packaging==26.3
 pathspec==1.1.1
-platformdirs==4.11.3
-Pygments==2.20.0
-pymdown-extensions==11.0.1
+platformdirs==4.11.11
+Pygments==2.21.0
+pymdown-extensions==12.0.1
 python-dateutil==2.9.0.post0
 PyYAML==6.0.3
 pyyaml_env_tag==1.1
 six==1.17.0
 watchdog==6.0.0
-zensical==0.0.54
+zensical==0.0.63

docs/types-and-platforms/mod-platforms/auto-curseforge.md

@@ -6,7 +6,9 @@ To manage a CurseForge modpack automatically with upgrade support, pinned or lat
 
 !!! info "CurseForge API key usage"
 
-    A CurseForge API key is _now_ included by this image; however, you can always supply your own instead. Go to their [developer console](https://console.curseforge.com/), generate an API key, and set the environment variable `CF_API_KEY`.
+    A CurseForge API key is _now_ included by this image on Java 17 and newer; however, you can always supply your own instead. Go to their [developer console](https://console.curseforge.com/), generate an API key, and set the environment variable `CF_API_KEY`.
+
+    The `java8` image (and other pre-Java 17 tags) does **not** include that key. Set `CF_API_KEY` yourself, or install the pack on a Java 17+ image first. See [Java 8](../../versions/java.md#java-8).
 
     When entering your API Key in a docker compose file you will need to escape any `$` character with a second `$`. Refer to [this compose file reference section](https://docs.docker.com/compose/compose-file/compose-file-v3/#variable-substitution) for more information.
 

docs/types-and-platforms/mod-platforms/modrinth-modpacks.md

@@ -50,7 +50,7 @@ Some mods, such as [MCInstance Loader](https://modrinth.com/mod/mcinstance-loade
 
 ## Excluding files
 
-To exclude client mods that are incorrectly declared by the modpack as server-compatible, set `MODRINTH_EXCLUDE_FILES` to a comma or newline delimited list of partial file names to exclude. You may need to set `MODRINTH_FORCE_SYNCHRONIZE` to "true" while iterating on a compatible set of mods to use.
+To exclude client mods that are incorrectly declared by the modpack as server-compatible, set `MODRINTH_EXCLUDE_FILES` to a comma or newline delimited list of file name matchers. Each entry is a case-insensitive substring of the file path, or a regular expression if surrounded with `/` (same convention as [`CF_FILENAME_MATCHER`](auto-curseforge.md#pinning-modpack-and-mod-loader-versions)). You may need to set `MODRINTH_FORCE_SYNCHRONIZE` to "true" while iterating on a compatible set of mods to use.
 
 !!! example
 
@@ -64,7 +64,7 @@ To exclude client mods that are incorrectly declared by the modpack as server-co
 
 ## Force-include files
 
-To force include client mods, set `MODRINTH_FORCE_INCLUDE_FILES` to a comma or newline delimited list of partial file names. You may need to set `MODRINTH_FORCE_SYNCHRONIZE` to "true" while iterating on a compatible set of mods to use.
+To force include client mods, set `MODRINTH_FORCE_INCLUDE_FILES` to a comma or newline delimited list of file name matchers using the same substring or `/regex/` rules as `MODRINTH_EXCLUDE_FILES`. You may need to set `MODRINTH_FORCE_SYNCHRONIZE` to "true" while iterating on a compatible set of mods to use.
 
 !!! example
 

docs/variables.md

@@ -288,6 +288,12 @@ alternatively, you can mount: <code>/etc/localtime:/etc/localtime:ro
             <td><code>false</code></td>
             <td>⬜️</td>
         </tr>
+        <tr>
+            <td><code>PRE_START_SCRIPT</code></td>
+            <td>Path to an executable run after setup and just before the server starts. The server is not started if it exits non-zero. See <a href="../configuration/misc-options/#pre-start-script">Pre-start script</a></td>
+            <td><code></code></td>
+            <td>⬜️</td>
+        </tr>
         <tr>
             <td><code>USE_FLARE_FLAGS</code></td>
             <td>To enable the JVM flags required to fully support the <a href="https://blog.airplane.gg/flare">Flare profiling suite</a>.</td>

docs/versions/java.md

@@ -111,7 +111,11 @@ Caused by: org.spongepowered.asm.mixin.throwables.ClassMetadataNotFoundException
 
 #### Java 8
 
-For Forge versions less than 1.18, you _must_ use the `java8-multiarch` (or other java8) image tag.
+For Forge versions less than 1.18, you _must_ use the `java8` (or other java8) image tag.
+
+!!! warning "Java 8 is in maintenance mode"
+
+    The `java8` / `java8-jdk` tags, and other pre-Java 17 tags (`java11`, `java16`), pin an older `mc-image-helper` that predates the baked-in CurseForge API key. `AUTO_CURSEFORGE` and `CURSEFORGE_FILES` on those images require you to set `CF_API_KEY` yourself. Java 17+ images include a key and do not need this.
 
 In general, if you see the following line in a server startup failure, then it means you need to be using Java 8 instead of the latest image Java version:
 

examples/auto-curseforge/atm10/.gitignore

@@ -0,0 +1 @@
+cf-api-key*

examples/auto-curseforge/atm10/docker-compose-with-secret.yml

@@ -0,0 +1,34 @@
+name: atm10-with-secret-file
+
+secrets:
+  cf-api-key:
+    file: ./cf-api-key.txt
+
+services:
+  mc:
+    image: itzg/minecraft-server
+    tty: true
+    stdin_open: true
+    ports:
+      - "25565:25565"
+    environment:
+      EULA: true
+      MOD_PLATFORM: AUTO_CURSEFORGE
+      CF_SLUG: all-the-mods-10
+      # Optional: select a specific version/file
+      # CF_FILENAME_MATCHER: "1.17"
+      CF_API_KEY_FILE: /run/secrets/cf-api-key
+      DEBUG: true
+      MEMORY: 4G
+      CF_OVERRIDES_EXCLUSIONS: |
+        # Not applicable for server side
+        shaderpacks/**
+    secrets:
+      - cf-api-key
+    volumes:
+      # Use managed volume by default, but can change to a relative path like
+      # ./data:/data
+      # to use a host directory
+      - mc-data:/data
+volumes:
+  mc-data:

examples/auto-curseforge/atm10/docker-compose.yml

@@ -8,10 +8,13 @@ services:
     environment:
       EULA: true
       MOD_PLATFORM: AUTO_CURSEFORGE
+      # Verified up to ATM10 8.1
       CF_SLUG: all-the-mods-10
       # Optional: select a specific version/file
       # CF_FILENAME_MATCHER: "1.17"
       MEMORY: 4G
+      CF_IGNORE_MISSING_FILES: |
+        config/ftbquests/quests/reward_tables/*.snbt
       CF_OVERRIDES_EXCLUSIONS: |
         # Not applicable for server side
         shaderpacks/**

examples/podman-quadlets/README.md

@@ -37,6 +37,8 @@ ln -s ${XDG_CONFIG_HOME}/containers/systemd/mc@.service ${XDG_CONFIG_HOME}/conta
 
 If running rootless, be sure to enable lingering with `sudo loginctl enable-linger $USER`.
 
+`GroupAdd=0` when rootless the equivalent of the user's group id, not the hosts root.
+
 Also note that source IPs are currently lost due to how rootless podman handles custom networks.
 This should be fixed in a future podman release.[^3]
 

examples/podman-quadlets/mc-router.container

@@ -6,6 +6,7 @@ Image=docker.io/itzg/mc-router
 ContainerName=%N
 AutoUpdate=registry
 UserNS=host
+GroupAdd=0
 Volume=%t/podman/podman.sock:/var/run/docker.sock:ro
 Network=minecraft.network
 PublishPort=25565:25565

files/cf-exclude-include.json

@@ -177,6 +177,7 @@
     "yungs-menu-tweaks",
     "zume"
   ],
+  "globalForceIncludes": ["simply-tooltips"],
   "modpacks": {
     "all-of-fabric-6": {
       "forceIncludes": ["revelationary"]
@@ -187,6 +188,9 @@
     "create-arcane-engineering": {
       "forceIncludes": ["just-enough-resources-jer"]
     },
+    "fantasy-minecraft-fabric": {
+      "forceIncludes": ["icon-leading-tooltip"]
+    },
     "ftb-stoneblock-4": {
       "forceIncludes": [
         "particular-reforged",

files/modrinth-exclude-include.json

@@ -49,7 +49,7 @@
     "fast-ip-ping",
     "fastquit",
     "feytweaks",
-    "figura",
+    "/(^|/)figura-/",
     "ForgeConfigScreens",
     "GeckoLibIrisCompat",
     "gpumemleakfix",
@@ -105,14 +105,11 @@
     "Zoomify",
     "zume"
   ],
-  "globalForceIncludes": [],
+  "globalForceIncludes": ["/(^|/)simplytooltips-/", "/(^|/)s-lib-/"],
   "modpacks": {
     "cobbleverse": {
       "excludes": [
         "cloth-config"
-      ],
-      "forceIncludes": [
-        "configurable"
       ]
     }
   }

renovate.json5

@@ -10,6 +10,16 @@
       "matchStrings": [
         "# renovate: datasource=(?<datasource>[a-z-]+?)(?: packageName=(?<packageName>.+?))?(?: versioning=(?<versioning>[a-z-]+))?\\s(?:ENV|ARG) .+?_VERSION=(?<currentValue>.+?)\\s"
       ]
+    },
+    {
+      "customType": "regex",
+      "description": "Update versioned images used by Dockerfile COPY --from instructions",
+      "managerFilePatterns": ["/^Dockerfile$/"],
+      "matchStrings": [
+        "COPY --from=(?<depName>[^:\\s]+):(?<currentValue>[^\\s]+)\\s"
+      ],
+      "datasourceTemplate": "docker",
+      "versioningTemplate": "docker"
     }
   ],
   "labels": ["dependencies"]

scripts/start-configuration

@@ -36,7 +36,7 @@ if isTrue "$PREFER_IPV6"; then
   export JVM_DD_OPTS
 fi
 
-if (( $(mc-image-helper java-release) >= 17 )); then
+if (( $(getJavaRelease) >= 17 )); then
   MC_IMAGE_HELPER_OPTS+=" --enable-native-access=ALL-UNNAMED"
   export MC_IMAGE_HELPER_OPTS
 fi

scripts/start-deployBukkitSpigot

@@ -43,7 +43,7 @@ function buildSpigotFromSource {
   fi
 
   logn ''
-  curl -sSL -o ${tempDir}/BuildTools.jar https://hub.spigotmc.org/jenkins/job/BuildTools/lastSuccessfulBuild/artifact/target/BuildTools.jar && \
+  curl -fsSL -o "${tempDir}/BuildTools.jar" https://hub.spigotmc.org/jenkins/job/BuildTools/lastSuccessfulBuild/artifact/target/BuildTools.jar && \
     java $jvmOpts -jar ${tempDir}/BuildTools.jar --rev "$VERSION" 2>&1 |tee ${spigotBuildLog}| while read l; do echo -n .; done; log "done"
 
   case ${TYPE^^} in

scripts/start-deployCF

@@ -127,7 +127,7 @@ if ! isTrue "${USE_MODPACK_START_SCRIPT:-true}"; then
     echo "${FTB_SERVER_MOD}" > $installMarker
   fi
 
-  SERVER=$(find "${FTB_BASE_DIR}" -maxdepth 2 -type f \( -path "/libraries/*" -o -path "/mods/*" \) -prune -o -name "forge*.jar" -not -name "forge*installer.jar" -print)
+  SERVER=$(find "${FTB_BASE_DIR}" -maxdepth 2 -type f \( -path "*/libraries/*" -o -path "*/mods/*" \) -prune -o -name "forge*.jar" -not -name "forge*installer.jar" -print)
   if [[ -z "${SERVER}" || ! -f "${SERVER}" ]]; then
     logError "Unable to locate installed forge server jar"
     isDebugging && find "${FTB_BASE_DIR}" -name "forge*.jar"
@@ -200,7 +200,7 @@ if [[ ! $startScript ]]; then
   # no, then look for a forge jar to run
 
   # Allow up to 2 levels since some modpacks have a top-level directory named for the modpack
-  forgeJar=$(find "${FTB_BASE_DIR}" -maxdepth 2 -type f \( -path "/libraries/*" -o -path "/mods/*" \) -prune -o -name "forge*.jar" -not -name "forge*installer.jar" -print)
+  forgeJar=$(find "${FTB_BASE_DIR}" -maxdepth 2 -type f \( -path "*/libraries/*" -o -path "*/mods/*" \) -prune -o -name "forge*.jar" -not -name "forge*installer.jar" -print)
   if [[ "$forgeJar" ]]; then
     FTB_BASE_DIR=$(dirname "${forgeJar}")
     export FTB_BASE_DIR

scripts/start-deployCustom

@@ -16,8 +16,8 @@ if isURL "${CUSTOM_SERVER}"; then
     log "Using previously downloaded jar at ${SERVER}"
   else
    log "Downloading custom server jar from ${CUSTOM_SERVER} ..."
-   if ! curl -sSL -o "${SERVER}" "${CUSTOM_SERVER}"; then
-      log "Failed to download from ${CUSTOM_SERVER}"
+   if ! curl -fsSL -o "${SERVER}" "${CUSTOM_SERVER}"; then
+      logError "Failed to download from ${CUSTOM_SERVER}"
       exit 2
     fi
   fi

scripts/start-deployFTBA

@@ -9,7 +9,7 @@ ftbInstallMarker=".ftb-installed"
 # shellcheck source=start-utils
 . "$(dirname "$0")/start-utils"
 isDebugging && set -x
-set -e
+set -e -o pipefail
 
 #
 #{
@@ -93,7 +93,10 @@ if isTrue "$FTB_FORCE_REINSTALL" ||
 
   log "Installing modpack ID ${FTB_MODPACK_ID}, version ID ${FTB_MODPACK_VERSION_ID}"
   log "This could take a while..."
-  ${ftbInstaller} -pack "${FTB_MODPACK_ID}" -version "${FTB_MODPACK_VERSION_ID}" -auto -force -no-java | tee ftb-installer.log
+  if ! ${ftbInstaller} -pack "${FTB_MODPACK_ID}" -version "${FTB_MODPACK_VERSION_ID}" -auto -force -no-java | tee ftb-installer.log; then
+    logError "FTB installer failed for modpack ID ${FTB_MODPACK_ID}, version ID ${FTB_MODPACK_VERSION_ID}"
+    exit 1
+  fi
   rm -f forge*installer.jar
 
   echo "${FTB_MODPACK_ID}=${FTB_MODPACK_VERSION_ID}" > ${ftbInstallMarker}
@@ -140,9 +143,9 @@ if [[ $SERVER = run.sh ]]; then
   elif grep -q forge "$SERVER"; then
     export FAMILY=FORGE
     export TYPE=FORGE
-  elif grep -q fabric run.s; then
-      export FAMILY=FABRIC
-      export TYPE=FABRIC
+  elif grep -q fabric "$SERVER"; then
+    export FAMILY=FABRIC
+    export TYPE=FABRIC
   else
     logError "Unrecognized loader type in $SERVER"
     cat "$SERVER"

scripts/start-deployForge

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 : "${FORGE_VERSION:=${FORGEVERSION:-RECOMMENDED}}"
-: "${FORGE_FORCE_REINSTALL:=false}}"
+: "${FORGE_FORCE_REINSTALL:=false}"
 
 # shellcheck source=start-utils
 . "${SCRIPTS:-$(dirname "$0")}/start-utils"

scripts/start-deployNeoForge

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 : "${NEOFORGE_VERSION:=latest}"
-: "${NEOFORGE_FORCE_REINSTALL:=false}}"
+: "${NEOFORGE_FORCE_REINSTALL:=false}"
 : "${NEOFORGE_INSTALLER:=}"
 
 # shellcheck source=start-utils

scripts/start-deploySpongeVanilla

@@ -22,18 +22,28 @@ case "$SPONGEBRANCH" in
 esac
 
 # If not SPONGEVERSION selected, detect last version on selected branch
-if [ -z $SPONGEVERSION ]; then
+if [ -z "$SPONGEVERSION" ]; then
   log "Choosing Version for Sponge"
-  SPONGEVERSION=$(curl -fsSL https://dl-api.spongepowered.org/v1/org.spongepowered/$TYPE | jq -r --arg SPONGEBRANCH "$SPONGEBRANCH" '.buildTypes.$SPONGEBRANCH.latest.version')
+  if ! SPONGEVERSION=$(curl -fsSL "https://dl-api.spongepowered.org/v1/org.spongepowered/$TYPE" | jq -r --arg SPONGEBRANCH "$SPONGEBRANCH" '.buildTypes[$SPONGEBRANCH].latest.version'); then
+    logError "Failed to resolve latest SpongeVanilla version from the Sponge downloads API"
+    exit 1
+  fi
+  if [[ -z $SPONGEVERSION || $SPONGEVERSION == null ]]; then
+    logError "Sponge downloads API did not return a version for branch $SPONGEBRANCH"
+    exit 1
+  fi
 fi
 
 VERSION="$SPONGEVERSION"
 export VERSION
 export SERVER="spongevanilla-$SPONGEVERSION.jar"
 
-if [ ! -e "$SERVER" ] || [ -n "$FORCE_REDOWNLOAD" ]; then
+if [ ! -e "$SERVER" ] || isTrue "${FORCE_REDOWNLOAD}"; then
   log "Downloading $SERVER ..."
-  curl -sSL -o "$SERVER" "https://repo.spongepowered.org/maven/org/spongepowered/$TYPE/$SPONGEVERSION/$SERVER"
+  if ! curl -fsSL -o "$SERVER" "https://repo.spongepowered.org/maven/org/spongepowered/$TYPE/$SPONGEVERSION/$SERVER"; then
+    logError "Failed to download $SERVER"
+    exit 1
+  fi
 fi
 
 export FAMILY=SPONGE

scripts/start-finalExec

@@ -4,10 +4,27 @@
 : "${SETUP_ONLY:=false}"
 : "${CUSTOM_JAR_EXEC:=}"
 : "${SERVER_RUNNER:=mc-server-runner}"
+: "${PRE_START_SCRIPT:=}"
 
 # shellcheck source=start-utils
 . "$(dirname "$0")/start-utils"
 isDebugging && set -x
+
+function runPreStartScript() {
+  if [[ ! $PRE_START_SCRIPT ]]; then
+    return
+  fi
+  if [[ ! -x $PRE_START_SCRIPT ]]; then
+    logError "PRE_START_SCRIPT $PRE_START_SCRIPT is not an executable file"
+    exit 1
+  fi
+  log "Running pre-start script $PRE_START_SCRIPT..."
+  if ! "$PRE_START_SCRIPT"; then
+    logError "Pre-start script $PRE_START_SCRIPT failed, so the server will not be started"
+    exit 1
+  fi
+}
+
 baseDataDir=/data
 tmpServerIconPath=/tmp/icon.img
 serverIconPath=${baseDataDir}/server-icon.png
@@ -491,7 +508,7 @@ if [[ ${STOP_SERVER_ANNOUNCE_DELAY} ]]; then
   mcServerRunnerArgs+=(--stop-server-announce-delay "${STOP_SERVER_ANNOUNCE_DELAY}s")
 fi
 if [[ ${STOP_SERVER_DELAY_COMMAND} ]]; then
-  mcServerRunnerArgs+=(--stop-server-delay-command "${STOP_SERVER_DELAY_COMMAND}s")
+  mcServerRunnerArgs+=(--stop-server-delay-command "${STOP_SERVER_DELAY_COMMAND}")
 fi
 if isTrue "${ENABLE_SSH}"; then
   mcServerRunnerArgs+=(--remote-console)
@@ -500,8 +517,12 @@ fi
 if [[ ${TYPE} == "CURSEFORGE" && "${SERVER}" ]]; then
   copyFilesForCurseForge
 
-  cd "${FTB_DIR}" || (logError "Can't go into ${FTB_DIR}"; exit 1)
+  if ! cd "${FTB_DIR}"; then
+    logError "Can't go into ${FTB_DIR}"
+    exit 1
+  fi
   log "Starting CurseForge server in ${FTB_DIR}..."
+  runPreStartScript
   if isTrue "${DEBUG_EXEC}"; then
     set -x
   fi
@@ -513,11 +534,15 @@ elif [[ ${TYPE} == "CURSEFORGE" ]]; then
 
 if isPercentage "$INIT_MEMORY" || isPercentage "$MAX_MEMORY"; then
 # Convert to bytes
-NORM_INIT_MEM=$(normalizeMemSize "$INIT_MEMORY")
-NORM_MAX_MEM=$(normalizeMemSize "$MAX_MEMORY")
-# Convert to MB
-((NORM_INIT_MEM*=1048576))
-((NORM_MAX_MEM*=1048576))
+if ! NORM_INIT_MEM=$(normalizeMemSize "$INIT_MEMORY"); then
+  exit 1
+fi
+if ! NORM_MAX_MEM=$(normalizeMemSize "$MAX_MEMORY"); then
+  exit 1
+fi
+# Convert bytes to MB
+((NORM_INIT_MEM/=1048576))
+((NORM_MAX_MEM/=1048576))
 
   cat > "${FTB_DIR}/settings-local.sh" <<EOF
 export MIN_RAM="${NORM_INIT_MEM}M"
@@ -541,7 +566,10 @@ fi
     fi
   fi
 
-  cd "${FTB_DIR}" || (logError "Can't go into ${FTB_DIR}"; exit 1)
+  if ! cd "${FTB_DIR}"; then
+    logError "Can't go into ${FTB_DIR}"
+    exit 1
+  fi
   log "Running FTB ${FTB_SERVER_START} in ${FTB_DIR} ..."
 
   finalArgs="${FTB_SERVER_START}"
@@ -559,6 +587,7 @@ fi
       JVM_ARGS=${JVM_ARGS//$'\n'/}
       sed -i "s~JAVA_ARGS=.*~JAVA_ARGS=\"${JVM_ARGS}\"~" "${FTB_DIR}/variables.txt"
   fi
+  runPreStartScript
   exec ${SERVER_RUNNER} "${mcServerRunnerArgs[@]}" -- "${finalArgs[@]}"
 elif [[ $SERVER =~ run.sh ]]; then
   log "Using Forge supplied run.sh script..."
@@ -567,6 +596,7 @@ elif [[ $SERVER =~ run.sh ]]; then
     echo "SETUP_ONLY: bash ${SERVER}"
     exit
   fi
+  runPreStartScript
   if isTrue "${DEBUG_EXEC}"; then
     set -x
   fi
@@ -604,6 +634,7 @@ else
     exit
   fi
 
+  runPreStartScript
   if isTrue "${DEBUG_EXEC}"; then
     set -x
   fi

scripts/start-setupModpack

@@ -9,6 +9,11 @@ set -e -o pipefail
 : "${PLUGINS_FILE:=}"
 : "${REMOVE_OLD_MODS_DEPTH:=1} "
 : "${REMOVE_OLD_MODS_INCLUDE:=*.jar,*-version.json}"
+: "${REMOVE_OLD_CONFIGS:=false}"
+: "${CONFIG_OUT_DIR:=/data/config}"
+: "${REMOVE_OLD_CONFIGS_DEPTH:=16}"
+: "${REMOVE_OLD_CONFIGS_INCLUDE:=*}"
+: "${REMOVE_OLD_CONFIGS_EXCLUDE:=}"
 : "${CF_USE_HTTP2:=false}" # CF downloads are faster with HTTP 1.1
 : "${MODRINTH_LOADER:=}"
 
@@ -25,6 +30,10 @@ if isTrue "${REMOVE_OLD_MODS}" && [ -z "${MODS_FILE}" ]; then
   rm -f "$sum_file"
 fi
 
+if isTrue "${REMOVE_OLD_CONFIGS}"; then
+  removeOldConfigs "$CONFIG_OUT_DIR"
+fi
+
 function handlePackwiz() {
   # If packwiz url passed, bootstrap packwiz and update mods before other modpack processing
   if [[ "${PACKWIZ_URL:-}" ]]; then
@@ -77,11 +86,13 @@ if [[ "$MODPACK" ]]; then
     mkdir -p "$PLUGINS_OUT_DIR"
     if ! unzip -o -d "$PLUGINS_OUT_DIR" /tmp/modpack.zip; then
       logError "Failed to unzip the modpack from ${MODPACK}"
+      exit 2
     fi
   else
     mkdir -p "$MODS_OUT_DIR"
     if ! unzip -o -d "$MODS_OUT_DIR" /tmp/modpack.zip; then
       logError "Failed to unzip the modpack from ${MODPACK}"
+      exit 2
     fi
   fi
   rm -f /tmp/modpack.zip

scripts/start-utils

@@ -368,9 +368,22 @@ function logRcon() {
 }
 
 function normalizeMemSize() {
+  # Convert a JVM-style size (k/m/g) or a percentage of the container memory
+  # limit into bytes. Bash arithmetic is integer-only, so percentages cannot
+  # use a 0.01 scale factor.
+  local input=${1?}
+  local val=${input:0:-1}
   local scale=1
-  local mem=1
-  case ${1,,} in
+  local mem
+
+  val=${val// /}
+  val=${val%%.*}
+  if ! [[ $val =~ ^[0-9]+$ ]]; then
+    logError "Unable to parse memory size '$input'"
+    return 1
+  fi
+
+  case ${input,,} in
   *k)
     scale=1024
     ;;
@@ -381,19 +394,25 @@ function normalizeMemSize() {
     scale=1073741824
     ;;
   *%)
-    # Get system memory
-    if [ -f "/sys/fs/cgroup/memory/memory.limit_in_bytes" ]; then
-    mem=$( cat /sys/fs/cgroup/memory/memory.limit_in_bytes )
-    elif [ -f "/sys/fs/cgroup/memory.max" ]; then
-    mem=$( cat /sys/fs/cgroup/memory.max )
+    if [ -f /sys/fs/cgroup/memory/memory.limit_in_bytes ]; then
+      mem=$(cat /sys/fs/cgroup/memory/memory.limit_in_bytes)
+    elif [ -f /sys/fs/cgroup/memory.max ]; then
+      mem=$(cat /sys/fs/cgroup/memory.max)
     fi
-    # Scale is used to transform percentages into decimals (eg. 60 -> 0.6)
-    scale=0.01
+    # cgroup v2 unlimited is "max"; cgroup v1 uses a large sentinel (~2^63).
+    if [[ $mem == max || ! $mem =~ ^[0-9]+$ ]] || (( mem > 1 << 62 )); then
+      mem=$(awk '/MemTotal:/ { print $2 * 1024 }' /proc/meminfo)
+    fi
+    if ! [[ $mem =~ ^[0-9]+$ ]]; then
+      logError "Unable to determine memory limit for percentage value '$input'"
+      return 1
+    fi
+    echo $((val * mem / 100))
+    return 0
     ;;
   esac
 
-  val=${1:0:-1}
-  echo $((val * scale * mem))
+  echo $((val * scale))
 }
 
 function compare_version() {
@@ -528,6 +547,23 @@ function removeOldMods {
   fi
 }
 
+function removeOldConfigs {
+  if [ -d "$1" ]; then
+    log "Removing old configs including='${REMOVE_OLD_CONFIGS_INCLUDE}' excluding='${REMOVE_OLD_CONFIGS_EXCLUDE}' up to depth=${REMOVE_OLD_CONFIGS_DEPTH}"
+    args=(
+      --delete
+      --type file
+      --min-depth=1 --max-depth "${REMOVE_OLD_CONFIGS_DEPTH}"
+      --name "${REMOVE_OLD_CONFIGS_INCLUDE}"
+      --exclude-name "${REMOVE_OLD_CONFIGS_EXCLUDE}"
+    )
+    if ! isDebugging; then
+      args+=(--quiet)
+    fi
+    mc-image-helper find "${args[@]}" "$1"
+  fi
+}
+
 function get() {
   mc-image-helper get "$@"
 }
@@ -579,12 +615,24 @@ function extract() {
 
   case "${type}" in
   application/zip)
+    if unzip -Z1 "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
+      logError "Refusing to extract $src because it contains path traversal entries"
+      return 1
+    fi
     unzip -o -q -d "${destDir}" "${src}" "$@"
     ;;
   application/x-tar | application/gzip | application/x-gzip | application/x-bzip2)
+    if tar -tf "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
+      logError "Refusing to extract $src because it contains path traversal entries"
+      return 1
+    fi
     tar -C "${destDir}" -xf "${src}" "$@"
     ;;
   application/zstd | application/x-zstd)
+    if tar --use-compress-program=unzstd -tf "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
+      logError "Refusing to extract $src because it contains path traversal entries"
+      return 1
+    fi
     tar -C "${destDir}" --use-compress-program=unzstd -xf "${src}" "$@"
     ;;
   *)
@@ -598,6 +646,23 @@ function getDistro() {
   grep -E "^ID=" /etc/os-release | cut -d= -f2 | sed -e 's/"//g'
 }
 
+function getJavaRelease() {
+  # Read the major version from the JDK's release file so no JVM has to start;
+  # the helper is the fallback when the file is missing.
+  local version
+  if [[ ${JAVA_HOME:-} && -f "$JAVA_HOME/release" ]]; then
+    version=$(sed -n -e 's/^JAVA_VERSION="\(.*\)"$/\1/p' "$JAVA_HOME/release")
+    # Java 8 and earlier report 1.8.0_312 and so on
+    version=${version#1.}
+    version=${version%%[._-]*}
+  fi
+  if isNumeric "${version:-}"; then
+    echo "$version"
+  else
+    mc-image-helper java-release
+  fi
+}
+
 function checkSum() {
   local sum_file=${1?}
 

tests/setuponlytests/remove-old-configs/docker-compose.yml

@@ -0,0 +1,43 @@
+services:
+  # copies an existing config into /data before mc starts, so REMOVE_OLD_CONFIGS
+  # has an old config to remove once the modpack config is installed
+  seed:
+    restart: "no"
+    image: ${IMAGE_TO_TEST:-itzg/minecraft-server}
+    entrypoint: ["bash", "-c", "mkdir -p /data/config && cp /seed/config/stale.txt /data/config/ && chown -R 1000:1000 /data"]
+    volumes:
+      - ./seed:/seed
+      - ./data:/data
+
+  web:
+    image: nginx
+    volumes:
+      - ./configs.zip:/usr/share/nginx/html/configs.zip:ro
+    healthcheck:
+      test: ["CMD", "curl", "--fail", "http://localhost/configs.zip"]
+      interval: 3s
+      timeout: 5s
+      retries: 3
+
+  mc:
+    restart: "no"
+    image: ${IMAGE_TO_TEST:-itzg/minecraft-server}
+    depends_on:
+      seed:
+        condition: service_completed_successfully
+      web:
+        condition: service_healthy
+    environment:
+      EULA: "true"
+      SETUP_ONLY: "true"
+      GENERIC_PACKS: http://web/configs.zip
+      REMOVE_OLD_CONFIGS: "true"
+      LOG_TIMESTAMP: "true"
+      # the following are only used to speed up test execution
+      TYPE: CUSTOM
+      CUSTOM_SERVER: /servers/fake.jar
+      VERSION: 1.18.1
+      DEBUG: "true"
+    volumes:
+      - ./data:/data
+      - ./fake.jar:/servers/fake.jar

tests/setuponlytests/remove-old-configs/seed/config/stale.txt

@@ -0,0 +1 @@
+old

tests/setuponlytests/remove-old-configs/verify.sh

@@ -0,0 +1,3 @@
+# verify that the old config was removed and the new one from the pack was installed
+mc-image-helper assert fileNotExists config/stale.txt
+mc-image-helper assert fileExists config/opt.yml