build(deps): bump the patches group in /docs with 2 updates (#4265)

Co-authored-by: LCB <me@lbellows.com>
Co-authored-by: Geoff Bourne <itzgeoff@gmail.com>

.github/workflows/auto-release.yml

@@ -8,11 +8,13 @@ jobs:
     runs-on: ubuntu-latest
     # If forked, changed to your username to enable auto-releases
     if: github.repository_owner == 'itzg'
-    permissions:
-      # allow for creating releases/tags
-      contents: write
     steps:
       - uses: zenengeo/github-auto-release-action@main
         with:
           stable-duration: 3d
-          force-duration: 14d  
+          force-duration: 14d
+          # It is important to use a token other than the workflow allocated GITHUB_TOKEN,
+          # since actions prevent loops by disallowing recursive workflow triggers with that token.
+          # In this case, the created tag needs to trigger the "Build and Publish" workflow.
+          token: '${{ secrets.GH_TOKEN }}'
+

.github/workflows/build.yml

@@ -18,6 +18,7 @@ on:
       - "zensical.toml"
       - ".readthedocs.yaml"
       - "renovate.json5"
+  workflow_dispatch:
 
 jobs:
   build:
@@ -29,10 +30,13 @@ jobs:
           - java25
           - java25-alpine
           - java25-jdk
+          - java25-graalvm
           - java21
           - java21-alpine
+          - java21-graalvm
           - java21-jdk
           - java17
+          - java17-graalvm
           - java16
           - java11
           - java8
@@ -45,8 +49,6 @@ jobs:
             baseImage: eclipse-temurin:25-jre-noble
             platforms: linux/amd64,linux/arm64,linux/riscv64
             mcVersion: latest
-            # forked build that include riscv64
-            knockdRepoOrg: Opvolger/knock
           - variant: java25-alpine
             baseImage: eclipse-temurin:25-jre-alpine
             platforms: linux/amd64,linux/arm64
@@ -55,6 +57,10 @@ jobs:
             baseImage: eclipse-temurin:25
             platforms: linux/amd64,linux/arm64
             mcVersion: latest
+          - variant: java25-graalvm
+            baseImage: container-registry.oracle.com/graalvm/jdk:25-ol10
+            platforms: linux/amd64,linux/arm64
+            mcVersion: latest
         # JAVA 21:
           - variant: java21
             baseImage: eclipse-temurin:21-jre
@@ -68,12 +74,20 @@ jobs:
             baseImage: eclipse-temurin:21-jre-alpine
             platforms: linux/amd64,linux/arm64
             mcVersion: 1.21.11
+          - variant: java21-graalvm
+            baseImage: container-registry.oracle.com/graalvm/jdk:21-ol10
+            platforms: linux/amd64,linux/arm64
+            mcVersion: 1.21.11
         # JAVA 17:
           - variant: java17
             # jammy doesn't work until minecraft updates to https://github.com/netty/netty/issues/12343
             baseImage: eclipse-temurin:17-jre-focal
             platforms: linux/amd64,linux/arm/v7,linux/arm64
             mcVersion: 1.20.4
+          - variant: java17-graalvm
+            baseImage: container-registry.oracle.com/graalvm/jdk:17-ol10
+            platforms: linux/amd64,linux/arm64
+            mcVersion: 1.20.4
         # JAVA 16
           - variant: java16
             baseImage: adoptopenjdk:16-jre-hotspot
@@ -105,6 +119,8 @@ jobs:
       # Assume they line up, but when forked change to your Docker Hub username
       DOCKER_HUB_ORG: ${{ github.repository_owner }}
       IMAGE_TO_TEST: "${{ github.repository_owner }}/minecraft-server:test-${{ matrix.variant }}-${{ github.run_id }}"
+      # NOTE: env values are always strings, so the boolean-valued ones below have to be
+      # compared with == 'true'. Used bare, the string "false" evaluates as true.
       HAS_IMAGE_REPO_ACCESS: ${{ secrets.DOCKER_USER != '' && secrets.DOCKER_PASSWORD != '' }}
       MAIN_VARIANT: java25
       PUSH: ${{ github.repository_owner == 'itzg' }}
@@ -179,15 +195,15 @@ jobs:
           tests/test.sh
 
       - name: Login to DockerHub
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@v4.6.0
-        if: env.HAS_IMAGE_REPO_ACCESS
+        if: env.HAS_IMAGE_REPO_ACCESS == 'true'
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Login to GHCR
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@v4.6.0
-        if: env.HAS_IMAGE_REPO_ACCESS
+        if: env.HAS_IMAGE_REPO_ACCESS == 'true'
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -200,13 +216,13 @@ jobs:
           platforms: ${{ matrix.platforms }}
           push: >
             ${{ 
-            env.PUSH &&
+            env.PUSH == 'true' &&
             (
               github.ref_type == 'tag' 
               || github.ref_name == github.event.repository.default_branch
               || startsWith(github.ref_name, 'test/')
               || ( github.event_name == 'pull_request' 
-                   && env.HAS_IMAGE_REPO_ACCESS 
+                   && env.HAS_IMAGE_REPO_ACCESS == 'true'
                    && contains(github.event.pull_request.labels.*.name, 'ci/push-image') 
                  )
             )

.github/workflows/stale-check.yml

@@ -13,7 +13,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Process Stale Issues
-        uses: actions/stale@v10
+        uses: actions/stale@v11
         with:
           stale-issue-label: status/stale
           stale-pr-label: status/stale

.github/workflows/verify-pr.yml

@@ -24,6 +24,7 @@ jobs:
         variant:
           - java25
           - java25-alpine
+          - java25-graalvm
           - java17
           - java8
         include:
@@ -39,6 +40,11 @@ jobs:
             mcVersion: latest
             # For GLIBC_2.34 support (and Alpine)
             knockdRepoOrg: Metalcape/knock
+          - variant: java25-graalvm
+            # stay aligned with build.yml
+            baseImage: container-registry.oracle.com/graalvm/jdk:25-ol10
+            platforms: linux/amd64,linux/arm64
+            mcVersion: latest
         # JAVA 17:
           - variant: java17
             # jammy doesn't work until minecraft updates to https://github.com/netty/netty/issues/12343
@@ -69,6 +75,9 @@ jobs:
       - name: Setup Docker Buildx
         uses: docker/setup-buildx-action@v4
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4.2.0
+
       - name: Confirm multi-arch build
         uses: docker/build-push-action@v7
         with:

Dockerfile

@@ -17,7 +17,7 @@ ARG KNOCKD_REPO_ORG=Metalcape/knock
 RUN --mount=target=/build,source=build \
     TARGET=${TARGETARCH}${TARGETVARIANT} \
     /build/run.sh install-packages
-COPY --from=tianon/gosu /gosu /usr/local/bin/
+COPY --from=tianon/gosu:1.19 /gosu /usr/local/bin/
 
 RUN --mount=target=/build,source=build \
     /build/run.sh setup-user
@@ -28,7 +28,7 @@ ARG APPS_REV=1
 ARG GITHUB_BASEURL=https://github.com
 
 # renovate: datasource=github-releases packageName=itzg/easy-add
-ARG EASY_ADD_VERSION=0.8.15
+ARG EASY_ADD_VERSION=0.8.17
 ADD ${GITHUB_BASEURL}/itzg/easy-add/releases/download/${EASY_ADD_VERSION}/easy-add_${TARGETOS}_${TARGETARCH}${TARGETVARIANT} /usr/bin/easy-add
 RUN chmod +x /usr/bin/easy-add
 
@@ -39,25 +39,25 @@ RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
 # renovate: datasource=github-releases packageName=itzg/rcon-cli
-ARG RCON_CLI_VERSION=1.7.6
+ARG RCON_CLI_VERSION=1.7.7
 RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --var version=${RCON_CLI_VERSION} --var app=rcon-cli --file {{.app}} \
   --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
 # renovate: datasource=github-releases packageName=itzg/mc-monitor
-ARG MC_MONITOR_VERSION=0.16.11
+ARG MC_MONITOR_VERSION=0.17.1
 RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --var version=${MC_MONITOR_VERSION} --var app=mc-monitor --file {{.app}} \
   --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
 # renovate: datasource=github-releases packageName=itzg/mc-server-runner
-ARG MC_SERVER_RUNNER_VERSION=1.15.1
+ARG MC_SERVER_RUNNER_VERSION=1.15.2
 RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --var version=${MC_SERVER_RUNNER_VERSION} --var app=mc-server-runner --file {{.app}} \
   --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
 # renovate: datasource=github-releases packageName=itzg/mc-image-helper versioning=loose
-ARG MC_HELPER_VERSION=1.62.1
+ARG MC_HELPER_VERSION=1.67.1
 ARG MC_HELPER_BASE_URL=${GITHUB_BASEURL}/itzg/mc-image-helper/releases/download/${MC_HELPER_VERSION}
 # used for cache busting local copy of mc-image-helper
 ARG MC_HELPER_REV=1

README.md

@@ -6,9 +6,10 @@
 [![](https://img.shields.io/badge/Donate-Buy%20me%20a%20coffee-orange.svg)](https://www.buymeacoffee.com/itzg)
 [![Documentation Status](https://readthedocs.org/projects/docker-minecraft-server/badge/?version=latest)](https://docker-minecraft-server.readthedocs.io/en/latest/?badge=latest)
 
- [![Read the docs](docs/img/banner-docs.png)](https://docker-minecraft-server.readthedocs.io/)
+[![Read the docs](docs/img/banner-docs.png)](https://docker-minecraft-server.readthedocs.io/)
 
 There you will find things like
+
 - [Quick start with Docker Compose](https://docker-minecraft-server.readthedocs.io/en/latest/#using-docker-compose)
 - Running [different versions of Minecraft](https://docker-minecraft-server.readthedocs.io/en/latest/versions/minecraft/) and using [various server types](https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms/) for Java Edition
 - [Setting server properties via container environment variables](https://docker-minecraft-server.readthedocs.io/en/latest/configuration/server-properties/)
@@ -36,6 +37,12 @@ This image only supports Java edition natively; however, if looking for a server
 
 <br clear="left" />
 
+<a href="https://seedloaf.com"><img src="https://seedloaf.com/images/logo.webp" alt="Seedloaf logo" width="48" align="left" /></a>
+
+<a href="https://seedloaf.com"><b>Seedloaf</b></a> - Built from scratch (by two nerds) on top of <code>itzg/minecraft-server</code>. Seedloaf offers free, and premium Minecraft servers where you have full control!
+
+<br clear="left" />
+
 <!-- additional sponsors repeat the pattern above: floated logo + blurb + clear-left break -->
 <!-- logo image preferrably hosted on an external, stable site at a size of 48x48px -->
 <!-- link to sponsor site -->

SECURITY.md

@@ -0,0 +1,39 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release or `latest` Docker tag receives security updates. If you discover a vulnerability, please test against the latest image version before reporting.
+
+## Automated Scans & Base Image Dependency Updates
+
+- **Automated Dependency Updates:** This repository utilizes automated background workflows to continuously upgrade base images, underlying dependencies, and the Go toolchain. Because CVE scanning tools flag vulnerabilities as soon as they are logged it is not practical to address them any faster than the automation is doing.
+- **Image Scan Reports & Triaging:** Please refrain from submitting raw scanner reports or screenshots (e.g., outputs from Trivy, Grype, or Docker Scout). CVEs in upstream base packages or system libraries are often constrained by upstream package maintainers. Submitting an issue or advisory for a scanner report does not accelerate a fix if the patch is not yet available in the upstream base image.
+- **Actionable PRs Welcome:** If a fix or patched package version **is** available upstream and has not yet been picked up by our automated build pipelines, submitting a pull request that updates the specific version pin or dependency is the best way to help speed up integration.
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
+
+To report a vulnerability privately:
+
+1. Navigate to the **[Security](https://github.com/itzg/docker-minecraft-server/security)** tab of this repository.
+2. Select **Report a vulnerability** to open a private security advisory.
+
+This allows us to review, reproduce, and resolve the issue in a private environment before public disclosure.
+
+---
+
+## Important Expectations & Bug Bounties
+
+* **No Financial Bounties:** This is an open-source, community-maintained project. We **do not** offer financial rewards, gift cards, or monetary bounties for vulnerability reports.
+* **Non-Critical & Automated Findings:** Reports generated purely by automated scanners (such as generic HTTP headers, low-severity container base image updates, or standard configuration warnings) without a working, practical proof-of-concept specific to this container will generally be closed.
+
+---
+
+## Dependency Upgrades & Pull Requests
+
+We welcome and appreciate community contributions! 
+
+If you identify an outdated or vulnerable upstream dependency (such as base packages, utilities, or underlying binaries), **we strongly encourage you to submit a Pull Request directly**. 
+
+Community-contributed PRs targeting dependency patches are the fastest way to get updates validated, built, and merged into the main release.

build/alpine/install-packages.sh

@@ -3,6 +3,13 @@
 set -e
 set -o pipefail
 
+# Patched knockd is only available for amd64 on Alpine, so install the package for other architectures
+knockPkg=""
+if [ "$TARGETARCH" != amd64 ]; then
+  knockPkg="knock"
+  echo "Installing knock package for $TARGETARCH architecture"
+fi
+
 # Install necessary packages
 # shellcheck disable=SC2086
 apk add --no-cache -U \
@@ -36,13 +43,18 @@ apk add --no-cache -U \
     numactl \
     jattach \
     gcompat \
+    "$knockPkg" \
     ${EXTRA_ALPINE_PACKAGES}
 
-# Download and install patched knockd
+if ! [ "$knockPkg" ]; then
-curl -fsSL -o /tmp/knock.tar.gz "https://github.com/${KNOCKD_REPO_ORG}/releases/download/${KNOCKD_VERSION}/knock-${KNOCKD_VERSION}-alpine-amd64.tar.gz"
+  # Download and install patched knockd
-tar -xf /tmp/knock.tar.gz -C /usr/local/ && rm /tmp/knock.tar.gz
+  knockdUrl="https://github.com/${KNOCKD_REPO_ORG}/releases/download/${KNOCKD_VERSION}/knock-${KNOCKD_VERSION}-alpine-amd64.tar.gz"
-ln -s /usr/local/sbin/knockd /usr/sbin/knockd
+  echo "Downloading knockd from $knockdUrl"
-setcap cap_net_raw=ep /usr/local/sbin/knockd
+  curl -fsSL -o /tmp/knock.tar.gz "$knockdUrl"
+  tar -xf /tmp/knock.tar.gz -C /usr/local/ && rm /tmp/knock.tar.gz
+  ln -s /usr/local/sbin/knockd /usr/sbin/knockd
+  setcap cap_net_raw=ep /usr/local/sbin/knockd
+fi
 
 # Set Git credentials globally
 cat <<EOF >> /etc/gitconfig

build/ol/install-packages.sh

@@ -66,16 +66,12 @@ fi
 # Clean up DNF when done
 dnf clean all
 
-cat <<EOF > /usr/local/sbin/knockd
+# Download and install patched knockd
-#!/bin/sh
+curl -fsSL -o /tmp/knock.tar.gz https://github.com/Metalcape/knock/releases/download/0.8.1/knock-0.8.1-$TARGET.tar.gz
-
+tar -xf /tmp/knock.tar.gz -C /usr/local/ && rm /tmp/knock.tar.gz
-echo "Auto-pause (using knockd) is currently unavailable on graalvm image variants"
+ln -s /usr/local/sbin/knockd /usr/sbin/knockd
-echo "Consider using a different image variant https://docker-minecraft-server.readthedocs.io/en/latest/versions/java/"
+ls -l /usr/local/sbin/knockd
-echo "or mc-router's auto scale up/down feature https://github.com/itzg/mc-router#docker-auto-scale-updown"
+setcap cap_net_raw=ep /usr/local/sbin/knockd
-exit 2
-EOF
-chmod 755 /usr/local/sbin/knockd
-# TODO restore retrieval from https://github.com/Metalcape/knock when tar's "Cannot open: Invalid argument" is solved
 
 # Set git credentials globally
 cat <<EOF >> /etc/gitconfig

build/ol/setup-user.sh

@@ -1,2 +1,6 @@
+#!/bin/sh
+
+set -e
+
 groupadd --gid 1000 minecraft
 useradd --system --shell /bin/false --uid 1000 -g minecraft --home /data minecraft

build/ubuntu/install-packages.sh

@@ -37,8 +37,13 @@ apt-get install -y \
 # Clean up APT when done
 apt-get clean
 
+if [ "$TARGETARCH" = riscv64 ]; then
+  KNOCKD_REPO_ORG=Opvolger/knock
+fi
 # Download and install patched knockd
-curl -fsSL -o /tmp/knock.tar.gz "https://github.com/${KNOCKD_REPO_ORG}/releases/download/${KNOCKD_VERSION}/knock-${KNOCKD_VERSION}-$TARGET.tar.gz"
+knockdUrl="https://github.com/${KNOCKD_REPO_ORG}/releases/download/${KNOCKD_VERSION}/knock-${KNOCKD_VERSION}-$TARGET.tar.gz"
+echo "Downloading knockd from $knockdUrl"
+curl -fsSL -o /tmp/knock.tar.gz "$knockdUrl"
 tar -xf /tmp/knock.tar.gz -C /usr/local/ && rm /tmp/knock.tar.gz
 ln -s /usr/local/sbin/knockd /usr/sbin/knockd
 setcap cap_net_raw=ep /usr/local/sbin/knockd

docs/configuration/server-properties.md

@@ -168,7 +168,9 @@ To [enforce the whitelist changes immediately](https://minecraft.wiki/w/Server.p
 
 !!! tip "Changing user API provider"
 
-    The usernames provided for whitelist and ops processing are resolved using either [PlayerDB](https://playerdb.co/) or [Mojang's API](https://wiki.vg/Mojang_API#Username_to_UUID). The default uses PlayerDB, but can be changed by setting the environment variable `USER_API_PROVIDER` to "mojang". Sometimes one or the other service can become overloaded, which is why there is the ability to switch providers.
+    When specifying usernames for whitelist and ops processing, use Minecraft: Java Edition profile names, not Xbox gamertags. They can differ even when they belong to the same Microsoft account. A player can review or change their Java profile name on the [Minecraft profile page](https://www.minecraft.net/en-us/msaprofile/mygames/editprofile).
+
+    Usernames are resolved using either [PlayerDB](https://playerdb.co/) or [Mojang's API](https://wiki.vg/Mojang_API#Username_to_UUID). The default uses PlayerDB, but can be changed by setting the environment variable `USER_API_PROVIDER` to "mojang". Sometimes one or the other service can become overloaded, which is why there is the ability to switch providers.
 
 
 ### Op/Administrator Players

docs/misc/related-projects.md

@@ -29,3 +29,7 @@ A tool that is bundled with this image to provide complex, re-usable preparation
 ### [itzg/rcon](https://github.com/itzg/docker-rcon-web-admin)
 
 An image that dockerizes [rcon-web-admin](https://github.com/rcon-web-admin/rcon-web-admin).
+
+### [AutoStopper](https://github.com/Criseda/AutoStopper)
+
+A Velocity plugin that stops idle backend servers and wakes them when players connect, with readiness-aware Docker lifecycle management.

docs/mods-and-plugins/curseforge-files.md

@@ -6,7 +6,7 @@ A specific file can be omitted from each reference to allow for auto-selecting t
 
 !!! info "CurseForge API key usage"
 
-    A CurseForge API key is _now_ included by this image; however, you can always supply your own instead. A CurseForge API key can be allocated and set with `CF_API_KEY` (or `CF_API_KEY_FILE`) [as described here](../types-and-platforms/mod-platforms/auto-curseforge.md#api-key).
+    A CurseForge API key is _now_ included by this image on Java 17 and newer; however, you can always supply your own instead. A CurseForge API key can be allocated and set with `CF_API_KEY` (or `CF_API_KEY_FILE`) [as described here](../types-and-platforms/mod-platforms/auto-curseforge.md#api-key). The `java8` image (and other pre-Java 17 tags) does not include a baked-in key; set `CF_API_KEY` yourself.
 
 ## Project-file references
 

docs/requirements.txt

@@ -1,25 +1,25 @@
-click==8.4.2
+click==8.5.0
 colorama==0.4.6
-deepmerge==2.1.0
+deepmerge==3.0
 ghp-import==2.1.0
-griffe==2.1.0
+griffe==2.2.0
 Jinja2==3.1.6
-Markdown==3.10.2
+Markdown==3.10.3
 MarkupSafe==3.0.3
 mergedeep==1.3.4
 mkdocs==1.6.1
 mkdocs-autorefs==1.4.4
 mkdocs-get-deps==0.2.2
 mkdocstrings==1.0.6
-mkdocstrings-python==2.0.5
+mkdocstrings-python==2.0.7
-packaging==26.2
+packaging==26.3
 pathspec==1.1.1
-platformdirs==4.10.0
+platformdirs==4.11.5
-Pygments==2.20.0
+Pygments==2.21.0
-pymdown-extensions==11.0.1
+pymdown-extensions==11.0.2
 python-dateutil==2.9.0.post0
 PyYAML==6.0.3
 pyyaml_env_tag==1.1
 six==1.17.0
 watchdog==6.0.0
-zensical==0.0.50
+zensical==0.0.57

docs/types-and-platforms/mod-platforms/auto-curseforge.md

@@ -6,7 +6,9 @@ To manage a CurseForge modpack automatically with upgrade support, pinned or lat
 
 !!! info "CurseForge API key usage"
 
-    A CurseForge API key is _now_ included by this image; however, you can always supply your own instead. Go to their [developer console](https://console.curseforge.com/), generate an API key, and set the environment variable `CF_API_KEY`.
+    A CurseForge API key is _now_ included by this image on Java 17 and newer; however, you can always supply your own instead. Go to their [developer console](https://console.curseforge.com/), generate an API key, and set the environment variable `CF_API_KEY`.
+
+    The `java8` image (and other pre-Java 17 tags) does **not** include that key. Set `CF_API_KEY` yourself, or install the pack on a Java 17+ image first. See [Java 8](../../versions/java.md#java-8).
 
     When entering your API Key in a docker compose file you will need to escape any `$` character with a second `$`. Refer to [this compose file reference section](https://docs.docker.com/compose/compose-file/compose-file-v3/#variable-substitution) for more information.
 
@@ -109,7 +111,7 @@ The latest modpack file and its associated mod loader will be located and instal
 
 - Use `CF_PAGE_URL`, but include the full URL to a specific file
 - Set `CF_FILE_ID` to the numerical file ID
-- Specify a substring to match the desired filename with `CF_FILENAME_MATCHER`
+- Specify either a substring or a regex pattern surrounded with "/" to match the desired filename with `CF_FILENAME_MATCHER`
 
 The following shows where to get the URL to the specific file and also shows where the file ID is located:
 
@@ -131,6 +133,21 @@ The following examples all refer to version 1.0.7 of ATM8:
   CF_FILENAME_MATCHER: 1.0.7
 ```
 
+To use a regular expression instead, surround the pattern with `/` characters:
+
+```yaml
+  # Matches filenames containing a 1.0.7 version
+  CF_SLUG: all-the-mods-8
+  CF_FILENAME_MATCHER: '/1\.0\.7/'
+```
+
+Regular expressions can use `^` to anchor a match to the beginning of the filename and `$` to anchor it to the end. The following matches an ATM8 filename that starts with `all-the-mods-8` and ends with `1.0.7.zip`:
+
+```yaml
+  CF_SLUG: all-the-mods-8
+  CF_FILENAME_MATCHER: '/^All the Mods 8-1\.0\.7\.zip$/'
+```
+
 Pinning modpack version also pins the mod loader (to the version specified by the modpack). Mod loader version cannot be pinned independently of the modpack.
 
 ### Custom modloader versions

docs/types-and-platforms/mod-platforms/gtnh.md

@@ -12,7 +12,7 @@ Configuration options with defaults:
 
 ## Set Modpack version
 
-As GTNH is a Minecraft 1.7.10 modpack, when using it your minecraft version is set to 1.7.10 by default. The [modpack version](https://www.gtnewhorizons.com/downloads/) can be selected by setting `GTNH_PACK_VERSION` to `latest`, `latest-dev` or any specific version number. `latest` will automatically select the latest full release version available and deploy the server with it (Note: this will also automatically update the server on startup). `latest-dev` does the same but selects the latest version marked as beta or RC (it won't select a full release version even if a newer exist). The third (and recommended) option is setting the server to a specific version like `2.8.1` to manage updates manually.
+As GTNH is a Minecraft 1.7.10 modpack, when using it your minecraft version is set to 1.7.10 by default. The [modpack version](https://www.gtnewhorizons.com/downloads/) can be selected by setting `GTNH_PACK_VERSION` to `latest`, `latest-beta` (formerly `latest-dev`) or any specific version number. `latest` will automatically select the latest full release version available and deploy the server with it (Note: this will also automatically update the server on startup). `latest-beta` does the same but selects the latest version marked as beta or RC (it won't select a full release version even if a newer exist). The third (and recommended) option is setting the server to a specific version like `2.8.1` to manage updates manually.
 
 > To actively prevent an update from happening you can set the environment variable `SKIP_GTNH_UPDATE_CHECK` to true this will prevent any update check from running, but will also prevent the server install from running, so just set it after the initial setup.
 
@@ -52,3 +52,11 @@ To deliver the intended GTNH by default, when running a GTNH server, the followi
 With java 17+ the server starts with `-Dfml.readTimeout=180 @java9args.txt -jar lwjgl3ify-forgePatches.jar`. 
 
 With java 8 the server stars with `-XX:+UseStringDeduplication -XX:+UseCompressedOops -XX:+UseCodeCacheFlushing -Dfml.readTimeout=180 -jar forge-1.7.10-10.13.4.1614-1.7.10-universal.jar`
+
+## Developer Versions
+
+To run the nightly developer builds of GTNH, set the environment variable `GTNH_USE_DAILY_BUILD` to true and set `GTNH_PACK_VERSION` either to `latest` or a specific run ID of the build workflow. The run ID can be found in the [GTNH GitHub Actions](https://github.com/GTNewHorizons/DreamAssemblerXXL/actions) page of the DreamAssemblerXXL repository. The run ID is the number in the URL of the workflow run, for example `123456789`. 
+
+Since downloads require authentication, you will also need to set the environment variable `GH_TOKEN` to a valid GitHub Personal Access Token with `public_repo` scope. You can create a token in your [GitHub settings](https://github.com/settings/tokens) page. Be sure to keep your token secret and do not share it with anyone. The token is only used to download the developer builds and is not stored anywhere in the server (except in the environment variables). 
+
+Keep in mind that developer builds are not stable and may contain bugs or incomplete features. Use them at your own risk. It is recommended to use the latest stable release for production servers!

docs/types-and-platforms/mod-platforms/modrinth-modpacks.md

@@ -50,7 +50,7 @@ Some mods, such as [MCInstance Loader](https://modrinth.com/mod/mcinstance-loade
 
 ## Excluding files
 
-To exclude client mods that are incorrectly declared by the modpack as server-compatible, set `MODRINTH_EXCLUDE_FILES` to a comma or newline delimited list of partial file names to exclude. You may need to set `MODRINTH_FORCE_SYNCHRONIZE` to "true" while iterating on a compatible set of mods to use.
+To exclude client mods that are incorrectly declared by the modpack as server-compatible, set `MODRINTH_EXCLUDE_FILES` to a comma or newline delimited list of file name matchers. Each entry is a case-insensitive substring of the file path, or a regular expression if surrounded with `/` (same convention as [`CF_FILENAME_MATCHER`](auto-curseforge.md#pinning-modpack-and-mod-loader-versions)). You may need to set `MODRINTH_FORCE_SYNCHRONIZE` to "true" while iterating on a compatible set of mods to use.
 
 !!! example
 
@@ -64,7 +64,7 @@ To exclude client mods that are incorrectly declared by the modpack as server-co
 
 ## Force-include files
 
-To force include client mods, set `MODRINTH_FORCE_INCLUDE_FILES` to a comma or newline delimited list of partial file names. You may need to set `MODRINTH_FORCE_SYNCHRONIZE` to "true" while iterating on a compatible set of mods to use.
+To force include client mods, set `MODRINTH_FORCE_INCLUDE_FILES` to a comma or newline delimited list of file name matchers using the same substring or `/regex/` rules as `MODRINTH_EXCLUDE_FILES`. You may need to set `MODRINTH_FORCE_SYNCHRONIZE` to "true" while iterating on a compatible set of mods to use.
 
 !!! example
 

docs/variables.md

@@ -204,6 +204,12 @@ alternatively, you can mount: <code>/etc/localtime:/etc/localtime:ro
             <td><code>easy</code></td>
             <td>⬜️</td>
         </tr>
+        <tr>
+            <td><code>HARDCORE</code></td>
+            <td>Enable hardcore mode. Set to <code>true</code> or <code>false</code>. This maps to the Minecraft server property <code>hardcore</code>.</td>
+            <td><code>false</code></td>
+            <td>⬜️</td>
+        </tr>
         <tr>
             <td><code>ICON</code></td>
             <td>The url or file path for the icon image to use for the server. It will be downloaded, scaled, and converted to the proper format.</td>
@@ -611,7 +617,7 @@ This image maps known server properties as described in [this section](configura
         </tr>
         <tr>
             <td><code>CF_FILENAME_MATCHER</code></td>
-            <td>Specify a substring to match the desired filename</td>
+            <td>Specify either a substring or a regex pattern surrounded with "/" to match the desired filename</td>
             <td><code></code></td>
             <td>⬜️</td>
         </tr>

docs/versions/java.md

@@ -17,10 +17,13 @@ where `<tag>` refers to the first column of this table:
 | java25        | 25           | Ubuntu | Hotspot     | amd64, arm64, riscv64 |      |
 | java25-alpine | 25           | Alpine | Hotspot     | amd64, arm64          |      |
 | java25-jdk    | 25           | Ubuntu | Hotspot+JDK | amd64, arm64          |      |
+| java25-graalvm | 25          | Oracle | Oracle GraalVM | amd64, arm64       | (2)(3) |
 | java21        | 21           | Ubuntu | Hotspot     | amd64, arm64          |      |
 | java21-jdk    | 21           | Ubuntu | Hotspot+JDK | amd64, arm64          |      |
 | java21-alpine | 21           | Alpine | Hotspot     | amd64, arm64          |      |
+| java21-graalvm | 21          | Oracle | Oracle GraalVM | amd64, arm64       | (2)(3) |
 | java17        | 17           | Ubuntu | Hotspot     | amd64, arm64, armv7   |      |
+| java17-graalvm | 17          | Oracle | Oracle GraalVM | amd64, arm64       | (2)(3) |
 | java16        | 16           | Ubuntu | Hotspot     | amd64, arm64, armv7   | (1)  |
 | java11        | 11           | Ubuntu | Hotspot     | amd64, arm64, armv7   |      |
 | java8         | 8            | Ubuntu | Hotspot     | amd64, arm64, armv7   |      |
@@ -28,6 +31,8 @@ where `<tag>` refers to the first column of this table:
 Notes
 
 1. This version of Java is [recommended for PaperMC 1.16.5](https://docs.papermc.io/paper/getting-started/#requirements)
+2. Based on the [Oracle GraalVM images](https://blogs.oracle.com/java/post/new-oracle-graalvm-container-images), which as of JDK 17, are now under the [GraalVM Free License](https://blogs.oracle.com/java/post/graalvm-free-license) incorporating what used to be known as the GraalVM Enterprise.
+3. Due to these images using Oracle Linux, (which is based on Red Hat Enterprise Linux) Forge Installer will not work due to its use of zlib-ng. Use other images for initial installation and Forge version upgrade.
 
 !!! example "Example using java8"
 
@@ -106,7 +111,11 @@ Caused by: org.spongepowered.asm.mixin.throwables.ClassMetadataNotFoundException
 
 #### Java 8
 
-For Forge versions less than 1.18, you _must_ use the `java8-multiarch` (or other java8) image tag.
+For Forge versions less than 1.18, you _must_ use the `java8` (or other java8) image tag.
+
+!!! warning "Java 8 is in maintenance mode"
+
+    The `java8` / `java8-jdk` tags, and other pre-Java 17 tags (`java11`, `java16`), pin an older `mc-image-helper` that predates the baked-in CurseForge API key. `AUTO_CURSEFORGE` and `CURSEFORGE_FILES` on those images require you to set `CF_API_KEY` yourself. Java 17+ images include a key and do not need this.
 
 In general, if you see the following line in a server startup failure, then it means you need to be using Java 8 instead of the latest image Java version:
 
@@ -121,7 +130,6 @@ Forge also doesn't support openj9 JVM implementation.
 
 The following image tags have been deprecated and are no longer receiving updates:
 
-- java25-graalvm, java21-graalvm, java17-graalvm
 - adopt13
 - adopt14
 - adopt15

examples/gtnh/docker-compose-type-gtnh.yaml

@@ -14,6 +14,9 @@ services:
       # GTNH_DELETE_BACKUPS: true
       # Use to prevent updates
       # SKIP_GTNH_UPDATE_CHECK: true
+      # Enable and set Token for daily builds
+      # GTNH_USE_DAILY_BUILD: true
+      # GH_TOKEN: mytoken
       MEMORY: 6G
       # Bring in standard extra mods described at https://wiki.gtnewhorizons.com/wiki/Additional_Mods
 #      MODS: |

examples/podman-quadlets/README.md

@@ -37,6 +37,8 @@ ln -s ${XDG_CONFIG_HOME}/containers/systemd/mc@.service ${XDG_CONFIG_HOME}/conta
 
 If running rootless, be sure to enable lingering with `sudo loginctl enable-linger $USER`.
 
+`GroupAdd=0` when rootless the equivalent of the user's group id, not the hosts root.
+
 Also note that source IPs are currently lost due to how rootless podman handles custom networks.
 This should be fixed in a future podman release.[^3]
 

examples/podman-quadlets/mc-router.container

@@ -6,6 +6,7 @@ Image=docker.io/itzg/mc-router
 ContainerName=%N
 AutoUpdate=registry
 UserNS=host
+GroupAdd=0
 Volume=%t/podman/podman.sock:/var/run/docker.sock:ro
 Network=minecraft.network
 PublishPort=25565:25565

files/cf-exclude-include.json

@@ -187,6 +187,9 @@
     "create-arcane-engineering": {
       "forceIncludes": ["just-enough-resources-jer"]
     },
+    "fantasy-minecraft-fabric": {
+      "forceIncludes": ["simply-tooltips", "icon-leading-tooltip"]
+    },
     "ftb-stoneblock-4": {
       "forceIncludes": [
         "particular-reforged",

files/modrinth-exclude-include.json

@@ -48,9 +48,8 @@
     "fancymenu",
     "fast-ip-ping",
     "fastquit",
-    "FauxCustomEntityData",
     "feytweaks",
-    "figura",
+    "/(^|/)figura-/",
     "ForgeConfigScreens",
     "GeckoLibIrisCompat",
     "gpumemleakfix",

files/nanolimbo-settings-patch.json

@@ -1,12 +1,16 @@
 {
-  "file": "/data/settings.yml",
+  "patches": [
-  "ops": [
     {
-      "$set": {
+      "file": "/data/settings.yml",
-        "path": "$.bind.port",
+      "ops": [
-        "value": "${SERVER_PORT}",
+        {
-        "value-type": "int"
+          "$set": {
-      }
+            "path": "$.bind.port",
+            "value": "${SERVER_PORT}",
+            "value-type": "int"
+          }
+        }
+      ]
     }
   ]
-}
+}

scripts/auto/autopause-daemon.sh

@@ -40,7 +40,7 @@ if ! mc-image-helper network-interfaces --check="$AUTOPAUSE_KNOCK_INTERFACE" ; t
   autopause_error_loop
 fi
 
-knockdArgs=(-c /tmp/knockd-config.cfg -d -i "$AUTOPAUSE_KNOCK_INTERFACE")
+knockdArgs=(-c /data/.knockd.cfg -d -i "$AUTOPAUSE_KNOCK_INTERFACE")
 if isTrue "${DEBUG_AUTOPAUSE}"; then
   knockdArgs+=(-D)
 fi

scripts/start-autopause

@@ -24,13 +24,13 @@ log "Autopause functionality enabled"
 
 isDebugging && set -x
 
-cp /image/knockd-config.cfg /tmp/knockd-config.cfg
+cp /image/knockd-config.cfg /data/.knockd.cfg
 
 function updatePort() {
   regseq="^\s*sequence\s*=\s*$1\s*$"
-  linenum=$(grep -nm${2} sequence /tmp/knockd-config.cfg | cut -d : -f 1 | tail -n1)
+  linenum=$(grep -nm${2} sequence /data/.knockd.cfg | cut -d : -f 1 | tail -n1)
-  if ! [[ $(awk "NR==$linenum" /tmp/knockd-config.cfg) =~ $regseq ]]; then
+  if ! [[ $(awk "NR==$linenum" /data/.knockd.cfg) =~ $regseq ]]; then
-    sed -i "${linenum}s/sequence.*/sequence = $1/" /tmp/knockd-config.cfg
+    sed -i "${linenum}s/sequence.*/sequence = $1/" /data/.knockd.cfg
     log "Updated $3 port in knockd config"
   fi
 }
@@ -67,6 +67,12 @@ fi
 # seq_cooldown cannot be larger than AUTOPAUSE_TIMEOUT_KN, otherwise the server may
 # become paused while knockd is still ignoring packets, preventing players from joining.
 let COOLDOWN=$AUTOPAUSE_TIMEOUT_KN/2
-sed -i "s/\(seq_cooldown *= *\).*/\1$COOLDOWN/" /tmp/knockd-config.cfg
+sed -i "s/\(seq_cooldown *= *\).*/\1$COOLDOWN/" /data/.knockd.cfg
+
+if isDebugging; then
+  echo "Autopause configuration: ======================================"
+  cat /data/.knockd.cfg
+  echo "==============================================================="
+fi
 
 "$(dirname "$0")/auto/autopause-daemon.sh" &

scripts/start-deployAutoCF

@@ -22,22 +22,11 @@ set -eu
 : "${CF_DOWNLOADS_REPO=$([ -d /downloads ] && echo '/downloads' || echo '')}"
 : "${CF_MODPACK_MANIFEST:=}"
 : "${CF_API_CACHE_DEFAULT_TTL:=}" # as ISO-8601 duration, such as P2D or PT12H
-: "${CF_API_KEY_FILE:=}" # Path to file containing CurseForge API key
 : "${CF_MOD_LOADER_VERSION:=}" # Override mod loader version
 : "${CF_USE_HTTP2:=false}" # CF downloads are faster with HTTP 1.1
 
 resultsFile=/data/.install-curseforge.env
 
-if [[ -n ${CF_API_KEY_FILE} ]]; then
-  if [[ -r "${CF_API_KEY_FILE}" ]]; then
-    CF_API_KEY="$(cat "${CF_API_KEY_FILE}")"
-    export CF_API_KEY
-  else
-    logError "CF_API_KEY_FILE is not readable: ${CF_API_KEY_FILE}"
-    exit 1
-  fi
-fi
-
 isDebugging && set -x
 
 ensureRemoveAllModsOff "MODPACK_PLATFORM=AUTO_CURSEFORGE"

scripts/start-deployBukkitSpigot

@@ -43,7 +43,7 @@ function buildSpigotFromSource {
   fi
 
   logn ''
-  curl -sSL -o ${tempDir}/BuildTools.jar https://hub.spigotmc.org/jenkins/job/BuildTools/lastSuccessfulBuild/artifact/target/BuildTools.jar && \
+  curl -fsSL -o "${tempDir}/BuildTools.jar" https://hub.spigotmc.org/jenkins/job/BuildTools/lastSuccessfulBuild/artifact/target/BuildTools.jar && \
     java $jvmOpts -jar ${tempDir}/BuildTools.jar --rev "$VERSION" 2>&1 |tee ${spigotBuildLog}| while read l; do echo -n .; done; log "done"
 
   case ${TYPE^^} in

scripts/start-deployCF

@@ -127,7 +127,7 @@ if ! isTrue "${USE_MODPACK_START_SCRIPT:-true}"; then
     echo "${FTB_SERVER_MOD}" > $installMarker
   fi
 
-  SERVER=$(find "${FTB_BASE_DIR}" -maxdepth 2 -type f \( -path "/libraries/*" -o -path "/mods/*" \) -prune -o -name "forge*.jar" -not -name "forge*installer.jar" -print)
+  SERVER=$(find "${FTB_BASE_DIR}" -maxdepth 2 -type f \( -path "*/libraries/*" -o -path "*/mods/*" \) -prune -o -name "forge*.jar" -not -name "forge*installer.jar" -print)
   if [[ -z "${SERVER}" || ! -f "${SERVER}" ]]; then
     logError "Unable to locate installed forge server jar"
     isDebugging && find "${FTB_BASE_DIR}" -name "forge*.jar"
@@ -200,7 +200,7 @@ if [[ ! $startScript ]]; then
   # no, then look for a forge jar to run
 
   # Allow up to 2 levels since some modpacks have a top-level directory named for the modpack
-  forgeJar=$(find "${FTB_BASE_DIR}" -maxdepth 2 -type f \( -path "/libraries/*" -o -path "/mods/*" \) -prune -o -name "forge*.jar" -not -name "forge*installer.jar" -print)
+  forgeJar=$(find "${FTB_BASE_DIR}" -maxdepth 2 -type f \( -path "*/libraries/*" -o -path "*/mods/*" \) -prune -o -name "forge*.jar" -not -name "forge*installer.jar" -print)
   if [[ "$forgeJar" ]]; then
     FTB_BASE_DIR=$(dirname "${forgeJar}")
     export FTB_BASE_DIR

scripts/start-deployCustom

@@ -16,8 +16,8 @@ if isURL "${CUSTOM_SERVER}"; then
     log "Using previously downloaded jar at ${SERVER}"
   else
    log "Downloading custom server jar from ${CUSTOM_SERVER} ..."
-   if ! curl -sSL -o "${SERVER}" "${CUSTOM_SERVER}"; then
+   if ! curl -fsSL -o "${SERVER}" "${CUSTOM_SERVER}"; then
-      log "Failed to download from ${CUSTOM_SERVER}"
+      logError "Failed to download from ${CUSTOM_SERVER}"
       exit 2
     fi
   fi

scripts/start-deployFTBA

@@ -9,7 +9,7 @@ ftbInstallMarker=".ftb-installed"
 # shellcheck source=start-utils
 . "$(dirname "$0")/start-utils"
 isDebugging && set -x
-set -e
+set -e -o pipefail
 
 #
 #{
@@ -93,7 +93,10 @@ if isTrue "$FTB_FORCE_REINSTALL" ||
 
   log "Installing modpack ID ${FTB_MODPACK_ID}, version ID ${FTB_MODPACK_VERSION_ID}"
   log "This could take a while..."
-  ${ftbInstaller} -pack "${FTB_MODPACK_ID}" -version "${FTB_MODPACK_VERSION_ID}" -auto -force -no-java | tee ftb-installer.log
+  if ! ${ftbInstaller} -pack "${FTB_MODPACK_ID}" -version "${FTB_MODPACK_VERSION_ID}" -auto -force -no-java | tee ftb-installer.log; then
+    logError "FTB installer failed for modpack ID ${FTB_MODPACK_ID}, version ID ${FTB_MODPACK_VERSION_ID}"
+    exit 1
+  fi
   rm -f forge*installer.jar
 
   echo "${FTB_MODPACK_ID}=${FTB_MODPACK_VERSION_ID}" > ${ftbInstallMarker}
@@ -140,9 +143,9 @@ if [[ $SERVER = run.sh ]]; then
   elif grep -q forge "$SERVER"; then
     export FAMILY=FORGE
     export TYPE=FORGE
-  elif grep -q fabric run.s; then
+  elif grep -q fabric "$SERVER"; then
-      export FAMILY=FABRIC
+    export FAMILY=FABRIC
-      export TYPE=FABRIC
+    export TYPE=FABRIC
   else
     logError "Unrecognized loader type in $SERVER"
     cat "$SERVER"

scripts/start-deployForge

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 : "${FORGE_VERSION:=${FORGEVERSION:-RECOMMENDED}}"
-: "${FORGE_FORCE_REINSTALL:=false}}"
+: "${FORGE_FORCE_REINSTALL:=false}"
 
 # shellcheck source=start-utils
 . "${SCRIPTS:-$(dirname "$0")}/start-utils"

scripts/start-deployGTNH

@@ -7,11 +7,13 @@
 function getGTNHdownloadPath(){
   gtnh_download_path=""
   local release_object=""
-  local current_java_version=""
-  current_java_version=$(mc-image-helper java-release)
 
   # Select release JSON object
-  if [ "$GTNH_PACK_VERSION" == "latest-dev" ]; then
+  # latest-dev will be removed in the future, but is still supported for now.
+  if [ "$GTNH_PACK_VERSION" == "latest-dev" ] || [ "$GTNH_PACK_VERSION" == "latest-beta" ]; then
+    if [ "$GTNH_PACK_VERSION" == "latest-dev" ]; then
+      logWarning "GTNH_PACK_VERSION=latest-dev is deprecated and will be removed in the future."
+    fi
     if ! release_object="$(
       curl -fsSL "https://downloads.gtnewhorizons.com/versions.json" \
         | jq -r '(.versions // .)|to_entries|sort_by(.value.releaseDate)|map(select(.value.title=="Beta release"))|.[-1]'
@@ -46,23 +48,18 @@ function getGTNHdownloadPath(){
   fi
   
   # Select compatible server files for java version
-  if (( current_java_version == 8 )); then
+  if (( java_version == 8 )); then
     gtnh_download_path=$(jq -r '.value.server.java8Url' <<< "$release_object")
     log "Use GTNH Server Java 8 release."
   
-  elif (( current_java_version >= 17 )); then
+  elif (( java_version >= 17 )); then
-    if (( current_java_version > $(jq '.value.maxJavaVersion' <<< "$release_object") )); then
+    if (( java_version > $(jq '.value.maxJavaVersion' <<< "$release_object") )); then
-      logError "Container Java version $current_java_version is not supported by GTNH. Try an older release."
+      logError "Container Java version $java_version is not supported by GTNH. Try an older release."
       exit 1
     fi
   
     gtnh_download_path=$(jq -r '.value.server.java17_2XUrl' <<< "$release_object")
     log "Use GTNH Server Java 17+ release."
-  
-  else
-    logError "Container Java version $current_java_version is not supported by GTNH."
-    exit 1
-  
   fi
   
   if [[ -z $gtnh_download_path ]]; then
@@ -73,6 +70,56 @@ function getGTNHdownloadPath(){
 
 }
 
+function getGTNHdownloadOptions(){
+  # Used for GTNH daily build downloads, to pass additional options to the download command.
+  gtnh_download_options=()
+  # Used for dryrun check
+  gtnh_download_path=""
+
+  # Check if GH_TOKEN is set for daily builds
+  if [ -z "$GH_TOKEN" ]; then
+    logError "GH_TOKEN environment variable must be set to use daily builds."
+    exit 1
+  fi
+
+  gtnh_download_options+=( --output-filename )
+
+  # prepare download options as an array to safely append patterns
+  if [ "$GTNH_PACK_VERSION" == "latest" ] || [ "$GTNH_PACK_VERSION" == "latest-dev" ]; then
+    if [ "$GTNH_PACK_VERSION" == "latest-dev" ]; then
+      logWarning "GTNH_PACK_VERSION=latest-dev is deprecated and will be removed in the future."
+    fi
+    gtnh_download_options+=( --workflow=daily-modpack-build.yml )
+    log "Using latest daily build for GTNH server files."
+  elif [ "$GTNH_PACK_VERSION" == "latest-beta" ]; then
+    gtnh_download_options+=( --workflow=daily-modpack-build.yml )
+    logWarning "Using daily build instead of latest beta release for GTNH server files. If this is not intended, set GTNH_USE_DAILY_BUILD=false to use the latest beta release instead."
+  else
+    gtnh_download_options+=( --run-id="$GTNH_PACK_VERSION" )
+    log "Using specific daily build run ID $GTNH_PACK_VERSION for GTNH server files."
+  fi
+
+  # Select compatible server files for java version
+  if (( java_version == 8 )); then
+    log "Use GTNH Server Java 8 release."
+    gtnh_download_options+=( --artifact-pattern='GTNH-daily-\d{4}-\d{2}-\d{2}\+\d+-server-java8\.zip' )
+  
+  elif (( java_version >= 17 )); then
+    log "Use GTNH Server Java 17+ release."
+    gtnh_download_options+=( --artifact-pattern='GTNH-daily-\d{4}-\d{2}-\d{2}\+\d+-server-java17-\d{2}\.zip' )
+  fi
+
+  debug "GTNH daily build download options: ${gtnh_download_options[*]}"
+
+  if ! gtnh_download_path=$(mc-image-helper github download-artifact --no-download "${gtnh_download_options[@]}" GTNewHorizons/DreamAssemblerXXL); then
+    logError "Failed to find a matching daily build for GTNH server files with the specified options."
+    exit 1
+  fi
+
+  debug "GTNH daily build download path: $gtnh_download_path"
+  
+}
+
 function deleteGTNHbackup(){
   log "Start deleting all config backups"
   if ! find . -maxdepth 1 -type d -name 'gtnh-upgrade-*' -exec rm -rf {} + ; then
@@ -81,24 +128,33 @@ function deleteGTNHbackup(){
 }
 
 function downloadGTNH(){
-  local gtnh_download=""
+  gtnh_download=""
   base_dir=/data/.tmp/gtnh_base
 
   debug "Creating temporary /data/.tmp/packs folder for GTNH download"
   mkdir -p /data/.tmp/packs
   trap 'rm -rf /data/.tmp' EXIT
-  
-  log "Downloading $gtnh_download_path."
-  if ! gtnh_download=$(mc-image-helper get -o /data/.tmp/packs --output-filename --skip-up-to-date "$gtnh_download_path"); then
-    logError "Failed to download $gtnh_download_path"
-    exit 1
-  fi
-  debug "Downloaded GTNH server files to $gtnh_download"
-
-  # Unpacking Server files into temporary directory
-  log "Unpacking Server Files into $base_dir"
   mkdir -p "${base_dir}"
-  extract "${gtnh_download}" "${base_dir}"
+  
+  if isTrue "$GTNH_USE_DAILY_BUILD"; then
+  log "Downloading Daily Build for GTNH server files."
+    # gtnh_download_options is injecting download parameters -> (--workflow or --run-id) and --artifact-pattern
+    if ! gtnh_download=$(mc-image-helper github download-artifact -o=$base_dir --unzip "${gtnh_download_options[@]}" GTNewHorizons/DreamAssemblerXXL); then
+      logError "Failed to download Daily Build for GTNH server files."
+      exit 1
+    fi
+  else 
+    log "Downloading $gtnh_download_path."
+    if ! gtnh_download=$(mc-image-helper get -o /data/.tmp/packs --output-filename --skip-up-to-date "$gtnh_download_path"); then
+      logError "Failed to download $gtnh_download_path"
+      exit 1
+    fi
+    debug "Downloaded GTNH server files to $gtnh_download"
+
+    # Unpacking Server files into temporary directory
+    log "Unpacking Server Files into $base_dir"
+    extract "${gtnh_download}" "${base_dir}"
+  fi
 
   # Remove any eula file since container manages it
   debug "Removing eula.txt from $base_dir"
@@ -209,16 +265,23 @@ function handleGTNH() {
   : "${GTNH_PACK_VERSION:=latest}"
   : "${GTNH_DELETE_BACKUPS:=false}"
   : "${SKIP_GTNH_UPDATE_CHECK:=false}"
-  debug "GTNH VAR CHECK: GTNH_DELETE_BACKUPS=$GTNH_DELETE_BACKUPS, GTNH_PACK_VERSION=$GTNH_PACK_VERSION, TYPE=$TYPE, SKIP_GTNH_UPDATE_CHECK=$SKIP_GTNH_UPDATE_CHECK"
+  : "${GTNH_USE_DAILY_BUILD:=false}"
+  
+  debug "GTNH VAR CHECK: GTNH_DELETE_BACKUPS=$GTNH_DELETE_BACKUPS, GTNH_PACK_VERSION=$GTNH_PACK_VERSION,  TYPE=$TYPE, SKIP_GTNH_UPDATE_CHECK=$SKIP_GTNH_UPDATE_CHECK, GTNH_USE_DAILY_BUILD=$GTNH_USE_DAILY_BUILD"
 
   if isTrue "$GTNH_DELETE_BACKUPS"; then
     deleteGTNHbackup
   fi
 
-  if [[ -n "$GTNH_PACK_VERSION" ]] && isFalse "$SKIP_GTNH_UPDATE_CHECK" ; then
+  if [[ -n "$GTNH_PACK_VERSION" ]] && isFalse "$SKIP_GTNH_UPDATE_CHECK"; then
     
-    getGTNHdownloadPath
+    if isFalse "$GTNH_USE_DAILY_BUILD"; then
-    log "Server files located! Will proceed update $gtnh_download_path."
+      getGTNHdownloadPath
+      log "Server files located! Will proceed update $gtnh_download_path."
+    else
+      getGTNHdownloadOptions
+      log "Will proceed update with daily build options: ${gtnh_download_options[*]}."
+    fi
 
 
     # Decide if update or install is needed or not.
@@ -239,7 +302,7 @@ function handleGTNH() {
       fi
 
       # Update .gtnh-version
-      basename "$gtnh_download_path" > /data/.gtnh-version
+      basename "$gtnh_download" > /data/.gtnh-version
 
       # Cleaning up temporary files
       rm -rf /data/.tmp
@@ -249,6 +312,9 @@ function handleGTNH() {
     fi
   else
     log "SKIP_GTNH_UPDATE_CHECK=$SKIP_GTNH_UPDATE_CHECK ... Skipping GTNH Update/Install"
+    if [[ ! -f /data/.gtnh-version ]]; then
+      logWarning "No .gtnh-version file detected! There might not be a valid GTNH server installation in /data. Please ensure that the server files are present or set SKIP_GTNH_UPDATE_CHECK=false to allow the script to download and install the server files."
+    fi
   fi
 }
 

scripts/start-deployNanoLimbo

@@ -158,10 +158,10 @@ traffic:
   # Ignored if -1.0
   maxPacketBytesRate: 2048.0
 EOF
+else
+  mc-image-helper patch --patch-env-prefix "" /image/nanolimbo-settings-patch.json
 fi
 
-mc-image-helper patch --patch-env-prefix "" /image/nanolimbo-settings-patch.json
-
 export SERVER
 export FAMILY=LIMBO
 

scripts/start-deployNeoForge

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 : "${NEOFORGE_VERSION:=latest}"
-: "${NEOFORGE_FORCE_REINSTALL:=false}}"
+: "${NEOFORGE_FORCE_REINSTALL:=false}"
 : "${NEOFORGE_INSTALLER:=}"
 
 # shellcheck source=start-utils

scripts/start-deploySpongeVanilla

@@ -22,18 +22,28 @@ case "$SPONGEBRANCH" in
 esac
 
 # If not SPONGEVERSION selected, detect last version on selected branch
-if [ -z $SPONGEVERSION ]; then
+if [ -z "$SPONGEVERSION" ]; then
   log "Choosing Version for Sponge"
-  SPONGEVERSION=$(curl -fsSL https://dl-api.spongepowered.org/v1/org.spongepowered/$TYPE | jq -r --arg SPONGEBRANCH "$SPONGEBRANCH" '.buildTypes.$SPONGEBRANCH.latest.version')
+  if ! SPONGEVERSION=$(curl -fsSL "https://dl-api.spongepowered.org/v1/org.spongepowered/$TYPE" | jq -r --arg SPONGEBRANCH "$SPONGEBRANCH" '.buildTypes[$SPONGEBRANCH].latest.version'); then
+    logError "Failed to resolve latest SpongeVanilla version from the Sponge downloads API"
+    exit 1
+  fi
+  if [[ -z $SPONGEVERSION || $SPONGEVERSION == null ]]; then
+    logError "Sponge downloads API did not return a version for branch $SPONGEBRANCH"
+    exit 1
+  fi
 fi
 
 VERSION="$SPONGEVERSION"
 export VERSION
 export SERVER="spongevanilla-$SPONGEVERSION.jar"
 
-if [ ! -e "$SERVER" ] || [ -n "$FORCE_REDOWNLOAD" ]; then
+if [ ! -e "$SERVER" ] || isTrue "${FORCE_REDOWNLOAD}"; then
   log "Downloading $SERVER ..."
-  curl -sSL -o "$SERVER" "https://repo.spongepowered.org/maven/org/spongepowered/$TYPE/$SPONGEVERSION/$SERVER"
+  if ! curl -fsSL -o "$SERVER" "https://repo.spongepowered.org/maven/org/spongepowered/$TYPE/$SPONGEVERSION/$SERVER"; then
+    logError "Failed to download $SERVER"
+    exit 1
+  fi
 fi
 
 export FAMILY=SPONGE

scripts/start-finalExec

@@ -213,8 +213,11 @@ fi
 : "${USE_MEOWICE_FLAGS:=false}"
 : "${USE_MEOWICE_GRAALVM_FLAGS:=false}"
 
-if isTrue "${USE_MEOWICE_FLAGS}"; then
+if isTrue "${USE_MEOWICE_FLAGS}" || isTrue "${USE_MEOWICE_GRAALVM_FLAGS}"; then
   java_major_version=$(mc-image-helper java-release)
+fi
+
+if isTrue "${USE_MEOWICE_FLAGS}"; then
   if [[ $java_major_version -gt 16 ]]; then
     log "Java version $java_major_version using MeowIce's flags for Java 17+"
   else
@@ -344,6 +347,11 @@ if isTrue "${USE_MEOWICE_FLAGS}"; then
   else
     log "cpu not x86_64, disabling architecture specific flags"
   fi
+  if [[ $java_major_version -gt 23 ]]; then
+    JVM_XX_OPTS="${JVM_XX_OPTS}
+    -XX:+UseCompactObjectHeaders
+    "
+  fi
 fi
 
 if isTrue "${USE_MEOWICE_GRAALVM_FLAGS}"; then
@@ -483,7 +491,7 @@ if [[ ${STOP_SERVER_ANNOUNCE_DELAY} ]]; then
   mcServerRunnerArgs+=(--stop-server-announce-delay "${STOP_SERVER_ANNOUNCE_DELAY}s")
 fi
 if [[ ${STOP_SERVER_DELAY_COMMAND} ]]; then
-  mcServerRunnerArgs+=(--stop-server-delay-command "${STOP_SERVER_DELAY_COMMAND}s")
+  mcServerRunnerArgs+=(--stop-server-delay-command "${STOP_SERVER_DELAY_COMMAND}")
 fi
 if isTrue "${ENABLE_SSH}"; then
   mcServerRunnerArgs+=(--remote-console)
@@ -492,7 +500,10 @@ fi
 if [[ ${TYPE} == "CURSEFORGE" && "${SERVER}" ]]; then
   copyFilesForCurseForge
 
-  cd "${FTB_DIR}" || (logError "Can't go into ${FTB_DIR}"; exit 1)
+  if ! cd "${FTB_DIR}"; then
+    logError "Can't go into ${FTB_DIR}"
+    exit 1
+  fi
   log "Starting CurseForge server in ${FTB_DIR}..."
   if isTrue "${DEBUG_EXEC}"; then
     set -x
@@ -505,11 +516,15 @@ elif [[ ${TYPE} == "CURSEFORGE" ]]; then
 
 if isPercentage "$INIT_MEMORY" || isPercentage "$MAX_MEMORY"; then
 # Convert to bytes
-NORM_INIT_MEM=$(normalizeMemSize "$INIT_MEMORY")
+if ! NORM_INIT_MEM=$(normalizeMemSize "$INIT_MEMORY"); then
-NORM_MAX_MEM=$(normalizeMemSize "$MAX_MEMORY")
+  exit 1
-# Convert to MB
+fi
-((NORM_INIT_MEM*=1048576))
+if ! NORM_MAX_MEM=$(normalizeMemSize "$MAX_MEMORY"); then
-((NORM_MAX_MEM*=1048576))
+  exit 1
+fi
+# Convert bytes to MB
+((NORM_INIT_MEM/=1048576))
+((NORM_MAX_MEM/=1048576))
 
   cat > "${FTB_DIR}/settings-local.sh" <<EOF
 export MIN_RAM="${NORM_INIT_MEM}M"
@@ -533,7 +548,10 @@ fi
     fi
   fi
 
-  cd "${FTB_DIR}" || (logError "Can't go into ${FTB_DIR}"; exit 1)
+  if ! cd "${FTB_DIR}"; then
+    logError "Can't go into ${FTB_DIR}"
+    exit 1
+  fi
   log "Running FTB ${FTB_SERVER_START} in ${FTB_DIR} ..."
 
   finalArgs="${FTB_SERVER_START}"

scripts/start-setupModpack

@@ -9,23 +9,13 @@ set -e -o pipefail
 : "${PLUGINS_FILE:=}"
 : "${REMOVE_OLD_MODS_DEPTH:=1} "
 : "${REMOVE_OLD_MODS_INCLUDE:=*.jar,*-version.json}"
-: "${CF_API_KEY_FILE:=}" # Path to file containing CurseForge API key
 : "${CF_USE_HTTP2:=false}" # CF downloads are faster with HTTP 1.1
 : "${MODRINTH_LOADER:=}"
 
 # shellcheck source=start-utils
 . "$(dirname "$0")/start-utils"
-isDebugging && set -x
 
-if [[ -n ${CF_API_KEY_FILE} ]]; then
+isDebugging && set -x
-  if [[ -r "${CF_API_KEY_FILE}" ]]; then
-    CF_API_KEY="$(cat "${CF_API_KEY_FILE}")"
-    export CF_API_KEY
-  else
-    logError "CF_API_KEY_FILE is not readable: ${CF_API_KEY_FILE}"
-    exit 1
-  fi
-fi
 
 sum_file=/data/.generic_pack.sum
 # Remove old mods/plugins
@@ -87,11 +77,13 @@ if [[ "$MODPACK" ]]; then
     mkdir -p "$PLUGINS_OUT_DIR"
     if ! unzip -o -d "$PLUGINS_OUT_DIR" /tmp/modpack.zip; then
       logError "Failed to unzip the modpack from ${MODPACK}"
+      exit 2
     fi
   else
     mkdir -p "$MODS_OUT_DIR"
     if ! unzip -o -d "$MODS_OUT_DIR" /tmp/modpack.zip; then
       logError "Failed to unzip the modpack from ${MODPACK}"
+      exit 2
     fi
   fi
   rm -f /tmp/modpack.zip

scripts/start-utils

@@ -368,9 +368,22 @@ function logRcon() {
 }
 
 function normalizeMemSize() {
+  # Convert a JVM-style size (k/m/g) or a percentage of the container memory
+  # limit into bytes. Bash arithmetic is integer-only, so percentages cannot
+  # use a 0.01 scale factor.
+  local input=${1?}
+  local val=${input:0:-1}
   local scale=1
-  local mem=1
+  local mem
-  case ${1,,} in
+
+  val=${val// /}
+  val=${val%%.*}
+  if ! [[ $val =~ ^[0-9]+$ ]]; then
+    logError "Unable to parse memory size '$input'"
+    return 1
+  fi
+
+  case ${input,,} in
   *k)
     scale=1024
     ;;
@@ -381,19 +394,25 @@ function normalizeMemSize() {
     scale=1073741824
     ;;
   *%)
-    # Get system memory
+    if [ -f /sys/fs/cgroup/memory/memory.limit_in_bytes ]; then
-    if [ -f "/sys/fs/cgroup/memory/memory.limit_in_bytes" ]; then
+      mem=$(cat /sys/fs/cgroup/memory/memory.limit_in_bytes)
-    mem=$( cat /sys/fs/cgroup/memory/memory.limit_in_bytes )
+    elif [ -f /sys/fs/cgroup/memory.max ]; then
-    elif [ -f "/sys/fs/cgroup/memory.max" ]; then
+      mem=$(cat /sys/fs/cgroup/memory.max)
-    mem=$( cat /sys/fs/cgroup/memory.max )
     fi
-    # Scale is used to transform percentages into decimals (eg. 60 -> 0.6)
+    # cgroup v2 unlimited is "max"; cgroup v1 uses a large sentinel (~2^63).
-    scale=0.01
+    if [[ $mem == max || ! $mem =~ ^[0-9]+$ ]] || (( mem > 1 << 62 )); then
+      mem=$(awk '/MemTotal:/ { print $2 * 1024 }' /proc/meminfo)
+    fi
+    if ! [[ $mem =~ ^[0-9]+$ ]]; then
+      logError "Unable to determine memory limit for percentage value '$input'"
+      return 1
+    fi
+    echo $((val * mem / 100))
+    return 0
     ;;
   esac
 
-  val=${1:0:-1}
+  echo $((val * scale))
-  echo $((val * scale * mem))
 }
 
 function compare_version() {
@@ -579,12 +598,24 @@ function extract() {
 
   case "${type}" in
   application/zip)
+    if unzip -Z1 "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
+      logError "Refusing to extract $src because it contains path traversal entries"
+      return 1
+    fi
     unzip -o -q -d "${destDir}" "${src}" "$@"
     ;;
   application/x-tar | application/gzip | application/x-gzip | application/x-bzip2)
+    if tar -tf "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
+      logError "Refusing to extract $src because it contains path traversal entries"
+      return 1
+    fi
     tar -C "${destDir}" -xf "${src}" "$@"
     ;;
   application/zstd | application/x-zstd)
+    if tar --use-compress-program=unzstd -tf "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
+      logError "Refusing to extract $src because it contains path traversal entries"
+      return 1
+    fi
     tar -C "${destDir}" --use-compress-program=unzstd -xf "${src}" "$@"
     ;;
   *)

tests/setuponlytests/nanolimbo-existing-settings/docker-compose.yml

@@ -0,0 +1,23 @@
+services:
+  # copies seed/ into /data before mc starts, so the NanoLimbo setup takes its
+  # "settings.yml already exists" path instead of writing the template
+  seed:
+    restart: "no"
+    image: ${IMAGE_TO_TEST:-itzg/minecraft-server}
+    entrypoint: ["bash", "-c", "cp /seed/settings.yml /data/ && chown -R 1000:1000 /data"]
+    volumes:
+      - ./seed:/seed
+      - ./data:/data
+
+  mc:
+    restart: "no"
+    image: ${IMAGE_TO_TEST:-itzg/minecraft-server}
+    depends_on:
+      seed:
+        condition: service_completed_successfully
+    environment:
+      EULA: "TRUE"
+      TYPE: NANOLIMBO
+      SERVER_PORT: "25599"
+    volumes:
+      - ./data:/data

tests/setuponlytests/nanolimbo-existing-settings/seed/settings.yml

@@ -0,0 +1,4 @@
+bind:
+  ip: '0.0.0.0'
+  port: 25565
+maxPlayers: 100

tests/setuponlytests/nanolimbo-existing-settings/verify.sh

@@ -0,0 +1,4 @@
+set -e
+# SERVER_PORT must have been applied to the settings.yml that was already there
+port=$(mc-image-helper yaml-path --file /data/settings.yml .bind.port)
+[ "$port" = 25599 ] || { echo "expected bind.port 25599 but was '$port'"; exit 1; }