Merge pull request #217 from jammsen/develop

Release 2024-02-21

CHANGELOG.md

@@ -2,47 +2,51 @@
 
 [Back to main](README.md#changelog)
 
+## 2024-02-21
+
+- Fixed major CVEs and added re-compiled gosu-amd64 binary to the repository (#214 #215)
+
 ## 2024-02-19
 
-* Added 15 seconds delay after save before backup (#209)
-* Changed standard RESTART_CRON_EXPRESSION to only once a day at 6pm
-  * Cause less illnesses on Pals that way
+- Added 15 seconds delay after save before backup (#209)
+- Changed standard RESTART_CRON_EXPRESSION to only once a day at 6pm
+  - Cause less illnesses on Pals that way
 
 ## 2024-02-13
 
-* Added the option to enable webhook curl debugging for weird error edge-cases
+- Added the option to enable webhook curl debugging for weird error edge-cases
 
 ## 2024-02-13
-* **Breaking changes:** 
-  * Changed the default BACKUP_RETENTION_POLICY to true and changed BACKUP_RETENTION_AMOUNT_TO_KEEP to 72, meaning 3 days worth of backup are kept in the default configuration
-  * Added the ability to change the PUID and PGID via environment variables (#117)
-    * This includes a user-process-jail mechanic including entrypoint-script, which makes sure that the gameserver is always working with the right permissions as only user steam and not root by accident or bug 
-* Mayor refactoring of the code-base to enable more feature requests based around automatic restarts and such. This includes:
-  * Adding new backupmanager
-  * Adding color-based echos and feedback-signals by color
-  * New structure and comments of Dockerfile environment variables
-  * New structure and comments of default.env template
-  * Added shell linting
-  * Fixed cron duplication (#169)
-  * Changed structure of the project and where files like documentation, includes, scripts and config-templates are to find
-  * Fixed typos in various documents
-  * Added multicore-bugfix, now multi-core-enhancment should be working (#190)
-  * Removed sensitive information from the servermanger logs (#194)
-  * Changed to always copy DefaultPalWorldSettings.ini at start mechanic (#195)
-  * Updated outdated Pocketpair documentation links
-  * Added automatic-restart-cron functionality (#50 #71 #139)
-  * Extended webhook usage (#120)
-* Requirements - What you need to do:
-  * **Read the readme, a lot has changed, there is a new part about the backupmanager and how to interact now with rconcli**
-  * Update to latest image
-  * Download new docker-compose.yml and new default.env
-    * Merge your settings and make sure that backup-settings, PGID and PUID are right
+- **Breaking changes:** 
+  - Changed the default BACKUP_RETENTION_POLICY to true and changed BACKUP_RETENTION_AMOUNT_TO_KEEP to 72, meaning 3 days worth of backup are kept in the default configuration
+  - Added the ability to change the PUID and PGID via environment variables (#117)
+    - This includes a user-process-jail mechanic including entrypoint-script, which makes sure that the gameserver is always working with the right permissions as only user steam and not root by accident or bug 
+- Mayor refactoring of the code-base to enable more feature requests based around automatic restarts and such. This includes:
+  - Adding new backupmanager
+  - Adding color-based echos and feedback-signals by color
+  - New structure and comments of Dockerfile environment variables
+  - New structure and comments of default.env template
+  - Added shell linting
+  - Fixed cron duplication (#169)
+  - Changed structure of the project and where files like documentation, includes, scripts and config-templates are to find
+  - Fixed typos in various documents
+  - Added multicore-bugfix, now multi-core-enhancment should be working (#190)
+  - Removed sensitive information from the servermanger logs (#194)
+  - Changed to always copy DefaultPalWorldSettings.ini at start mechanic (#195)
+  - Updated outdated Pocketpair documentation links
+  - Added automatic-restart-cron functionality (#50 #71 #139)
+  - Extended webhook usage (#120)
+- Requirements - What you need to do:
+  - **Read the readme, a lot has changed, there is a new part about the backupmanager and how to interact now with rconcli**
+  - Update to latest image
+  - Download new docker-compose.yml and new default.env
+    - Merge your settings and make sure that backup-settings, PGID and PUID are right
 
 ## 2024-02-03
 
-* Added changes to shutdown-webhook notifications (#120)
-* Added rcon.sh again for having alias function calls that do not bloat the servermanager
-* Refactored how webhook messages function are called and added alias functions
-* Added a changelog, from various request resources
+- Added changes to shutdown-webhook notifications (#120)
+- Added rcon.sh again for having alias function calls that do not bloat the servermanager
+- Refactored how webhook messages function are called and added alias functions
+- Added a changelog, from various request resources
 
 [Back to main](README.md#changelog)

Dockerfile

@@ -1,3 +1,40 @@
+FROM golang:1.22.0-bookworm as rconclibuilder
+
+WORKDIR /build
+
+ENV CGO_ENABLED=0 \
+    GORCON_RCONCLI_URL=https://github.com/gorcon/rcon-cli/archive/refs/tags/v0.10.3.tar.gz \
+    GORCON_RCONCLI_DIR=rcon-cli-0.10.3 \
+    GORCON_RCONCLI_TGZ=v0.10.3.tar.gz \
+    GORCON_RCONCLI_TGZ_SHA1SUM=33ee8077e66bea6ee097db4d9c923b5ed390d583
+
+RUN curl -fsSLO "$GORCON_RCONCLI_URL" \
+    && echo "${GORCON_RCONCLI_TGZ_SHA1SUM}  ${GORCON_RCONCLI_TGZ}" | sha1sum -c - \
+    && tar -xzf "$GORCON_RCONCLI_TGZ" \
+    && mv "$GORCON_RCONCLI_DIR"/* ./ \
+    && rm "$GORCON_RCONCLI_TGZ" \
+    && rm -Rf "$GORCON_RCONCLI_DIR" \
+    && go build -v ./cmd/gorcon
+
+FROM debian:bookworm-slim as supercronicverify
+
+# Latest releases available at https://github.com/aptible/supercronic/releases
+ENV SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.29/supercronic-linux-amd64 \
+    SUPERCRONIC=supercronic-linux-amd64 \
+    SUPERCRONIC_SHA1SUM=cd48d45c4b10f3f0bfdd3a57d054cd05ac96812b
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends --no-install-suggests ca-certificates curl \
+    && apt-get autoremove -y --purge \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+ RUN curl -fsSLO "$SUPERCRONIC_URL" \
+    && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
+    && chmod +x "$SUPERCRONIC" \
+    && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
+    && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic
+
 FROM --platform=linux/amd64 cm2network/steamcmd:root
 
 LABEL maintainer="Sebastian Schmidt - https://github.com/jammsen/docker-palworld-dedicated-server"
@@ -129,45 +166,27 @@ EXPOSE 8211/udp
 EXPOSE 25575/tcp
 
 # Install minimum required packages for dedicated server
+COPY --from=rconclibuilder /build/gorcon /usr/local/bin/rcon
+COPY --from=supercronicverify /usr/local/bin/supercronic /usr/local/bin/supercronic
+
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends --no-install-suggests gosu procps xdg-user-dirs \
+    && apt-get install -y --no-install-recommends --no-install-suggests procps xdg-user-dirs \
     && apt-get autoremove -y --purge \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
-# Latest releases available at https://github.com/aptible/supercronic/releases
-ENV SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.29/supercronic-linux-amd64 \
-    SUPERCRONIC=supercronic-linux-amd64 \
-    SUPERCRONIC_SHA1SUM=cd48d45c4b10f3f0bfdd3a57d054cd05ac96812b
-
-RUN curl -fsSLO "$SUPERCRONIC_URL" \
-    && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
-    && chmod +x "$SUPERCRONIC" \
-    && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
-    && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic
-
-# Latest releases available at https://github.com/gorcon/rcon-cli/releases
-ENV RCON_URL=https://github.com/gorcon/rcon-cli/releases/download/v0.10.3/rcon-0.10.3-amd64_linux.tar.gz \
-    RCON_TGZ=rcon-0.10.3-amd64_linux.tar.gz \
-    RCON_TGZ_MD5SUM=8601c70dcab2f90cd842c127f700e398 \
-    RCON_BINARY=rcon
-
-RUN curl -fsSLO "$RCON_URL" \
-    && echo "${RCON_TGZ_MD5SUM} ${RCON_TGZ}" | md5sum -c - \
-    && tar xfz rcon-0.10.3-amd64_linux.tar.gz \
-    && chmod +x "rcon-0.10.3-amd64_linux/$RCON_BINARY" \
-    && mv "rcon-0.10.3-amd64_linux/$RCON_BINARY" "/usr/local/bin/${RCON_BINARY}" \
-    && rm -Rf rcon-0.10.3-amd64_linux rcon-0.10.3-amd64_linux.tar.gz
-
 COPY --chmod=755 entrypoint.sh /
 COPY --chmod=755 scripts/ /scripts
 COPY --chmod=755 includes/ /includes
 COPY --chmod=755 configs/rcon.yaml /home/steam/steamcmd/rcon.yaml
+COPY --chmod=755 gosu-amd64 /usr/local/bin/gosu
 
 RUN mkdir -p "$BACKUP_PATH" \
     && ln -s /scripts/backupmanager.sh /usr/local/bin/backup \
     && ln -s /scripts/rconcli.sh /usr/local/bin/rconcli \
-    && ln -s /scripts/restart.sh /usr/local/bin/restart
+    && ln -s /scripts/restart.sh /usr/local/bin/restart \
+    && gosu --version \
+    && gosu nobody true
 
 VOLUME ["${GAME_ROOT}"]
 

docker-build.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+docker build "$@" --tag=jammsen/palworld-dedicated-server:latest .

docker-compose.yml

@@ -1,7 +1,6 @@
 version: '3.9'
 services:
   palworld-dedicated-server:
-    #build: .
     container_name: palworld-dedicated-server
     image: jammsen/palworld-dedicated-server:latest
     restart: unless-stopped