Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Minimize Root Processes #167

Merged
merged 9 commits into from
Jan 28, 2024

Conversation

Dashboy1998
Copy link
Contributor

@Dashboy1998 Dashboy1998 commented Jan 28, 2024

Context

  • Currently you start the container as root and during the start up process everything is ran as root except the command with su.
    image

  • Currently when backups are created they are created and owned by root however on next boot the permission is changed to steam:steam

  • When starting with a PUID or PGID that is not 1000 you get the following error: /tmp/dumps is not owned by us - delete and recreate

palworld-server-test  | *****STARTING INSTALL/UPDATE*****
palworld-server-test  | tid(22) burning pthread_key_t == 0 so we never use it
palworld-server-test  | Redirecting stderr to '/home/steam/Steam/logs/stderr.txt'
palworld-server-test  | Logging directory: '/home/steam/Steam/logs'
palworld-server-test  | /tmp/dumps is not owned by us - delete and recreate
palworld-server-test  | [  0%] Checking for available updates..
  • Currently When starting with a PGID that is not 1000 then /home/steam/ has the group 1000 instead of steam.

Choices

  • Overall trying to reduce having to run as root.
  • Moved all commands which needed su to start.sh
  • Other commands in start.sh should be ran as steam anyways
  • Everything in start.sh should only need to be ran as steam user

Test instructions

Unless explicitly stated your PUID or PGID should not be 0 for testing

image

  1. Start container with a PGID that is neither 0 or 1000
    1. verify you do not get this error: /tmp/dumps is not owned by us - delete and recreate
    2. verify /home/steam is owned by steam:steam: docker exec palworld-server bash -c "ls -ll /home/steam"
  2. After the server has finished booting use top to verify the only processes running as root are init.sh, su, and top: docker exec -t palworld-server top
  3. Run a backup as root and verify that the file is owned by steam:steam: docker exec palworld-server bash -c "backup && ls -l /palworld/backups/"
  4. Run a backup as steam and verify that the file is owned by steam:steam: docker exec -u steam palworld-server bash -c "backup && ls -l /palworld/backups/"
  5. Test rcon-cli as root: docker exec -it palworld-server-test rcon-cli
  6. Test rcon-cli as steam: docker exec -it -u steam palworld-server-test rcon-cli
  7. Verify you don't get this message /tmp/dumps is not owned by us - delete and recreate when:
    1. Start container with a PGID that is 0
    2. Start container with a PUID that is 0
    3. Start container with a PUID & PGID that is 0
  8. Verify you still get this message Running as root is not supported, please fix your PUID and PGID! when:
    1. Start container with a PGID that is 0
    2. Start container with a PUID that is 0
    3. Start container with a PUID & PGID that is 0

Checklist before requesting a review

  • I have performed a self-review of my code
  • I've added documentation about this change to the README.
  • I've not introduced breaking changes.

@Dashboy1998 Dashboy1998 changed the title DRAFT: Minimize Root Processes Minimize Root Processes Jan 28, 2024
@Dashboy1998 Dashboy1998 force-pushed the minimize-root-processes branch from b6223de to e0d4e6c Compare January 28, 2024 04:07
Copy link
Owner

@thijsvanloef thijsvanloef left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've tested it, and everything works fine, however this is a big PR that I would also like a second opinion on. Posting this in the discord, hopefully someone else would be able to look at it.

Once again thank you for all the contributions :D

@MSpreckels
Copy link
Contributor

LGTM

Maybe eventually we can go for non root when we run steam non root (if that is even possible)

@thijsvanloef thijsvanloef merged commit 5b72e8d into thijsvanloef:main Jan 28, 2024
4 checks passed
@Dashboy1998 Dashboy1998 deleted the minimize-root-processes branch January 28, 2024 12:48
@Dashboy1998 Dashboy1998 restored the minimize-root-processes branch January 28, 2024 12:53
@Dashboy1998 Dashboy1998 mentioned this pull request Jan 30, 2024
3 tasks
MusclePr pushed a commit to MusclePr/palworld-server-docker that referenced this pull request Jun 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants