Repository navigation
fix: start Minecraft Java as non-root - #56
jebediah47 wants to merge 1 commit into
Conversation
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Release version and pod security context minecraft-java/module.yaml, minecraft-java/template.yaml |
The module and template versions change to 2.9.1. The template sets the run-as user, run-as group, and filesystem group to 1000. |
Estimated code review effort: 2 (Simple) | ~8 minutes
Change: Bug fix
Suggested reviewers: valgulnecron
Merge Risk: 
d8afe
-
The security-context change is compatible with the supported Minecraft Java image variants based on the inspected image and entrypoint contracts.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main change: configuring Minecraft Java to start as a non-root user. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)
-
Finishing Touches
-
Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Minecraft currently starts as root and relies on gosu to drop privileges before launching Java. On our ARM64 host with Ubuntu kernel 7.0.0-42 and gosu 1.19 (Go 1.24.6), gosu spins in sched_yield at 100% CPU; Java never starts and the startup probe cannot connect to port 25565.
Set GameTemplate security.runAsUser, runAsGroup, and fsGroup to 1000. The itzg entrypoint detects non-root execution and launches configuration directly, bypassing gosu. Bump the module and template versions from 2.9.0 to 2.9.1 for publication.
Live validation: applying these security settings to the installed template started Minecraft successfully as UID/GID 1000, preserved the existing world, and passed pod readiness. Existing data was already owned by UID/GID 1000.
Related Ubuntu report: https://bugs.launchpad.net/bugs/2172422
Module validator: passed with zero errors. Advisory warnings cover the existing /data mount matching image WorkingDir and the absence of an explicit HOME; the live Java 25 startup and readiness check passed with these settings. Other Java variants were checked statically, not launched. git diff --check passed.
Summary by CodeRabbit