chown knockd to minecraft user

Dockerfile

@@ -1,19 +1,6 @@
-# syntax = docker/dockerfile:1.5-labs
+# syntax = docker/dockerfile:1.3
+
 ARG BASE_IMAGE=eclipse-temurin:17-jre-focal
-
-###############################################################################
-FROM container-registry.oracle.com/graalvm/native-image:21-ol8 AS helper-native-builder
-
-# findutils provides xargs, needed by gradle wrapper
-RUN microdnf install findutils
-
-ADD https://github.com/itzg/mc-image-helper.git#feat/graalvm /helper
-
-WORKDIR /helper
-
-RUN ./gradlew nativeCompile
-
-###############################################################################
 FROM ${BASE_IMAGE}
 
 # hook into docker BuildKit --platform support
@@ -22,14 +9,11 @@ ARG TARGETOS
 ARG TARGETARCH
 ARG TARGETVARIANT
 
-# CI system should set this to a hash or git revision of the build directory and it's contents to
-# ensure consistent cache updates.
-ARG BUILD_FILES_REV=1
 RUN --mount=target=/build,source=build \
-    REV=${BUILD_FILES_REV} TARGET=${TARGETARCH}${TARGETVARIANT} /build/run.sh install-packages
+    /build/run.sh setup-user
 
 RUN --mount=target=/build,source=build \
-    REV=${BUILD_FILES_REV} /build/run.sh setup-user
+    TARGET=${TARGETARCH}${TARGETVARIANT} /build/run.sh install-packages
 
 COPY --chmod=644 files/sudoers* /etc/sudoers.d
 
@@ -55,7 +39,13 @@ RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --var version=1.9.0 --var app=mc-server-runner --file {{.app}} \
   --from https://github.com/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
-COPY --from=helper-native-builder /helper/build/native/nativeCompile/mc-image-helper /usr/bin/
+ARG MC_HELPER_VERSION=1.36.1
+ARG MC_HELPER_BASE_URL=https://github.com/itzg/mc-image-helper/releases/download/${MC_HELPER_VERSION}
+# used for cache busting local copy of mc-image-helper
+ARG MC_HELPER_REV=1
+RUN curl -fsSL ${MC_HELPER_BASE_URL}/mc-image-helper-${MC_HELPER_VERSION}.tgz \
+  | tar -C /usr/share -zxf - \
+  && ln -s /usr/share/mc-image-helper-${MC_HELPER_VERSION}/bin/mc-image-helper /usr/bin
 
 VOLUME ["/data"]
 WORKDIR /data

build/alpine/install-packages.sh

@@ -26,9 +26,12 @@ apk add --no-cache -U \
     zstd \
     nfs-utils \
     libpcap \
-    libwebp
+    libwebp \
+    libcap
 
 # Patched knockd
 curl -fsSL -o /tmp/knock.tar.gz https://github.com/Metalcape/knock/releases/download/0.8.1/knock-0.8.1-alpine-amd64.tar.gz
 tar -xf /tmp/knock.tar.gz -C /usr/local/ && rm /tmp/knock.tar.gz
 ln -s /usr/local/sbin/knockd /usr/sbin/knockd
+setcap cap_net_raw=ep /usr/local/sbin/knockd
+chown minecraft /usr/local/sbin/knockd

build/ol/install-packages.sh

@@ -46,3 +46,5 @@ bash /build/ol/install-gosu.sh
 curl -fsSL -o /tmp/knock.tar.gz https://github.com/Metalcape/knock/releases/download/0.8.1/knock-0.8.1-$TARGET.tar.gz
 tar -xf /tmp/knock.tar.gz -C /usr/local/ && rm /tmp/knock.tar.gz
 ln -s /usr/local/sbin/knockd /usr/sbin/knockd
+setcap cap_net_raw=ep /usr/local/sbin/knockd
+chown minecraft /usr/local/sbin/knockd

build/ubuntu/install-packages.sh

@@ -35,4 +35,6 @@ apt-get clean
 curl -fsSL -o /tmp/knock.tar.gz https://github.com/Metalcape/knock/releases/download/0.8.1/knock-0.8.1-$TARGET.tar.gz
 tar -xf /tmp/knock.tar.gz -C /usr/local/ && rm /tmp/knock.tar.gz
 ln -s /usr/local/sbin/knockd /usr/sbin/knockd
+setcap cap_net_raw=ep /usr/local/sbin/knockd
+chown minecraft /usr/local/sbin/knockd
 find /usr/lib -name 'libpcap.so.0.8' -execdir cp '{}' libpcap.so.1 \;

docs/configuration/server-properties.md

@@ -24,9 +24,9 @@ renders
 
 ![](../img/motd-example.png)
 
-To produce a multi-line MOTD, embed a newline character as `\n` in the string, such as
+To produce a multi-line MOTD, you will need to double escape the newline such as
 
-    -e MOTD="Line one\nLine two"
+    -e MOTD="Line one\\nLine two"
 
 ### Difficulty
 

docs/misc/autopause-autostop/autopause.md

@@ -38,6 +38,8 @@ The following environment variables define the behaviour of auto-pausing:
   describes period of the daemonized state machine, that handles the pausing of the process (resuming is done independently)
 - `AUTOPAUSE_KNOCK_INTERFACE`, default `eth0`
   <br>Describes the interface passed to the `knockd` daemon. If the default interface does not work, run the `ifconfig` command inside the container and derive the interface receiving the incoming connection from its output. The passed interface must exist inside the container. Using the loopback interface (`lo`) does likely not yield the desired results.
+- `AUTOPAUSE_SUDO`, default "true"
+  specifies if the knockd service should be run via sudo in order to elevate its privileges
 
 !!! tip
 

docs/requirements.txt

@@ -1,9 +1,9 @@
 mkdocs == 1.5.3
 mkdocs-material-extensions == 1.2
-mkdocs-material == 9.4.6
+mkdocs-material == 9.4.3
 mkdocs-autorefs == 0.5.0
 mkdocstrings == 0.23.0
 mkdocs-literate-nav == 0.6.1
 mdx-gh-links == 0.3.1
 mkdocs-click == 0.8.1
-mkdocs-static-i18n == 1.1.1
+mkdocs-static-i18n == 1.0.6

files/auto/autopause-daemon.sh

@@ -45,7 +45,11 @@ if isTrue "${DEBUG_AUTOPAUSE}"; then
   knockdArgs+=(-D)
 fi
 
-sudo /usr/local/sbin/knockd "${knockdArgs[@]}"
+if isTrue "${AUTOPAUSE_SUDO:-true}"; then
+  sudo /usr/local/sbin/knockd "${knockdArgs[@]}"
+else
+  /usr/local/sbin/knockd "${knockdArgs[@]}"
+fi
 if [ $? -ne 0 ] ; then
   logAutopause "Failed to start knockd daemon."
   logAutopause "Probable cause: Unable to attach to interface \"$AUTOPAUSE_KNOCK_INTERFACE\"."

scripts/start-setupModpack

@@ -239,7 +239,10 @@ function handleModrinthProjects() {
   if [[ $MODRINTH_PROJECTS ]] && isFamily HYBRID FORGE FABRIC SPIGOT; then
     if isFamily HYBRID FORGE; then
       loader=forge
+    elif isFamily FABRIC; then
+      loader=fabric
     else
+      # we're left with Bukkit/Spigot down-lines where plugins seem to be
       loader="${TYPE,,}"
     fi
     mc-image-helper modrinth \

scripts/start-setupRbac

@@ -5,10 +5,6 @@ IFS=$'\n\t'
 : "${EXISTING_OPS_FILE:=SKIP}"
 : "${EXISTING_WHITELIST_FILE:=SKIP}"
 
-# shellcheck source=start-utils
-. "${SCRIPTS:-/}start-utils"
-isDebugging && set -x
-
 if [[ -v APPEND_OPS ]] && isTrue "${APPEND_OPS}"; then
   EXISTING_OPS_FILE=MERGE
 elif [[ -v OVERRIDE_OPS ]] && isTrue "${OVERRIDE_OPS}"; then
@@ -21,6 +17,10 @@ elif [[ -v OVERRIDE_WHITELIST ]] && isTrue "${OVERRIDE_WHITELIST}"; then
   EXISTING_WHITELIST_FILE=SYNCHRONIZE
 fi
 
+# shellcheck source=start-utils
+. "${SCRIPTS:-/}start-utils"
+isDebugging && set -x
+
 sharedArgs=(--version="$VERSION")
 if isFalse "${ONLINE_MODE:-true}"; then
   sharedArgs+=( --offline )

scripts/start-setupServerProperties

@@ -28,6 +28,9 @@ function customizeServerProps {
       MOTD="{\"text\":\"${MOTD}\"}"
     fi
   fi
+  if [[ $MOTD ]]; then
+    MOTD="$(echo "$MOTD" | mc-image-helper asciify)"
+  fi
 
   if [[ -v MODE ]]; then
     log "Setting mode"

tests/setuponlytests/spiget/require.sh

@@ -1 +0,0 @@
-[[ $EXTENDED_TESTS ]] || exit 1