mirror of
https://github.com/factoriotools/factorio-docker.git
synced 2025-07-10 02:55:21 +02:00
feat: Add rootless Docker support
Implements #547 - Add support for rootless Docker images to avoid permission issues. Key changes: - Add Dockerfile.rootless that runs as UID 1000 by default - Create simplified entrypoint script without chown operations - Add build-rootless.py to build rootless variants with -rootless suffix - Document rootless usage in README-ROOTLESS.md - Update main README with rootless section The rootless images eliminate common permission problems by: - Running as non-root from the start (USER 1000:1000) - Avoiding recursive chown operations that can cause race conditions - Using open permissions (777) on directories during build - Not supporting PUID/PGID environment variables This provides a cleaner solution for rootless Docker users and those experiencing permission issues with volumes. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Florian Kinder
93
docker/Dockerfile.rootless
Normal file
93
docker/Dockerfile.rootless
Normal file
@ -0,0 +1,93 @@
|
||||
# build rcon client
|
||||
FROM debian:stable-slim AS rcon-builder
|
||||
RUN apt-get -q update \
|
||||
&& DEBIAN_FRONTEND=noninteractive apt-get -qy install build-essential
|
||||
|
||||
WORKDIR /src
|
||||
COPY rcon/ /src
|
||||
RUN make
|
||||
|
||||
# build factorio image
|
||||
FROM debian:stable-slim
|
||||
LABEL maintainer="https://github.com/factoriotools/factorio-docker"
|
||||
|
||||
ARG BOX64_VERSION=v0.2.4
|
||||
|
||||
# optionally utilize a built-in map-gen-preset (see data/base/prototypes/map-gen-presets
|
||||
ARG PRESET
|
||||
|
||||
# number of retries that curl will use when pulling the headless server tarball
|
||||
ARG CURL_RETRIES=8
|
||||
|
||||
ENV PORT=34197 \
|
||||
RCON_PORT=27015 \
|
||||
SAVES=/factorio/saves \
|
||||
PRESET="$PRESET" \
|
||||
CONFIG=/factorio/config \
|
||||
MODS=/factorio/mods \
|
||||
SCENARIOS=/factorio/scenarios \
|
||||
SCRIPTOUTPUT=/factorio/script-output \
|
||||
DLC_SPACE_AGE="true"
|
||||
|
||||
SHELL ["/bin/bash", "-eo", "pipefail", "-c"]
|
||||
|
||||
RUN apt-get -q update \
|
||||
&& DEBIAN_FRONTEND=noninteractive apt-get -qy install ca-certificates curl jq pwgen xz-utils procps gettext-base --no-install-recommends \
|
||||
&& if [[ "$(uname -m)" == "aarch64" ]]; then \
|
||||
echo "installing ARM compatability layer" \
|
||||
&& DEBIAN_FRONTEND=noninteractive apt-get -qy install unzip --no-install-recommends \
|
||||
&& curl -LO https://github.com/ptitSeb/box64/releases/download/${BOX64_VERSION}/box64-GENERIC_ARM-RelWithDebInfo.zip \
|
||||
&& unzip box64-GENERIC_ARM-RelWithDebInfo.zip -d /bin \
|
||||
&& rm -f box64-GENERIC_ARM-RelWithDebInfo.zip \
|
||||
&& chmod +x /bin/box64; \
|
||||
fi \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# version checksum of the archive to download
|
||||
ARG VERSION
|
||||
ARG SHA256
|
||||
|
||||
LABEL factorio.version=${VERSION}
|
||||
|
||||
ENV VERSION=${VERSION} \
|
||||
SHA256=${SHA256}
|
||||
|
||||
RUN set -ox pipefail \
|
||||
&& if [[ "${VERSION}" == "" ]]; then \
|
||||
echo "build-arg VERSION is required" \
|
||||
&& exit 1; \
|
||||
fi \
|
||||
&& if [[ "${SHA256}" == "" ]]; then \
|
||||
echo "build-arg SHA256 is required" \
|
||||
&& exit 1; \
|
||||
fi \
|
||||
&& archive="/tmp/factorio_headless_x64_$VERSION.tar.xz" \
|
||||
&& mkdir -p /opt /factorio \
|
||||
&& curl -sSL "https://www.factorio.com/get-download/$VERSION/headless/linux64" -o "$archive" --retry $CURL_RETRIES \
|
||||
&& echo "$SHA256 $archive" | sha256sum -c \
|
||||
|| (sha256sum "$archive" && file "$archive" && exit 1) \
|
||||
&& tar xf "$archive" --directory /opt \
|
||||
&& chmod ugo=rwx /opt/factorio \
|
||||
&& rm "$archive" \
|
||||
&& ln -s "$SCENARIOS" /opt/factorio/scenarios \
|
||||
&& ln -s "$SAVES" /opt/factorio/saves \
|
||||
&& mkdir -p /opt/factorio/config/
|
||||
|
||||
COPY files/*.sh /
|
||||
COPY files/docker-entrypoint-rootless.sh /docker-entrypoint.sh
|
||||
COPY files/config.ini /opt/factorio/config/config.ini
|
||||
COPY --from=rcon-builder /src/rcon /bin/rcon
|
||||
|
||||
# Make all scripts executable
|
||||
RUN chmod +x /*.sh
|
||||
|
||||
# Set proper permissions for the factorio directory
|
||||
RUN chmod -R 777 /opt/factorio /factorio
|
||||
|
||||
VOLUME /factorio
|
||||
EXPOSE $PORT/udp $RCON_PORT/tcp
|
||||
|
||||
# Run as non-root user (UID 1000 is common for the first user in rootless containers)
|
||||
USER 1000:1000
|
||||
|
||||
ENTRYPOINT ["/docker-entrypoint.sh"]
|
||||
124
docker/files/docker-entrypoint-rootless.sh
Executable file
124
docker/files/docker-entrypoint-rootless.sh
Executable file
@ -0,0 +1,124 @@
|
||||
#!/bin/bash
|
||||
set -eoux pipefail
|
||||
INSTALLED_DIRECTORY=$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")
|
||||
FACTORIO_VOL=/factorio
|
||||
LOAD_LATEST_SAVE="${LOAD_LATEST_SAVE:-true}"
|
||||
GENERATE_NEW_SAVE="${GENERATE_NEW_SAVE:-false}"
|
||||
PRESET="${PRESET:-""}"
|
||||
SAVE_NAME="${SAVE_NAME:-""}"
|
||||
BIND="${BIND:-""}"
|
||||
CONSOLE_LOG_LOCATION="${CONSOLE_LOG_LOCATION:-""}"
|
||||
|
||||
# Create directories if they don't exist
|
||||
# In rootless mode, these should be writable by the container user
|
||||
mkdir -p "$FACTORIO_VOL"
|
||||
mkdir -p "$SAVES"
|
||||
mkdir -p "$CONFIG"
|
||||
mkdir -p "$MODS"
|
||||
mkdir -p "$SCENARIOS"
|
||||
mkdir -p "$SCRIPTOUTPUT"
|
||||
|
||||
# Generate RCON password if needed
|
||||
if [[ ! -f $CONFIG/rconpw ]]; then
|
||||
pwgen 15 1 >"$CONFIG/rconpw"
|
||||
fi
|
||||
|
||||
# Copy default configs if they don't exist
|
||||
if [[ ! -f $CONFIG/server-settings.json ]]; then
|
||||
cp /opt/factorio/data/server-settings.example.json "$CONFIG/server-settings.json"
|
||||
fi
|
||||
|
||||
if [[ ! -f $CONFIG/map-gen-settings.json ]]; then
|
||||
cp /opt/factorio/data/map-gen-settings.example.json "$CONFIG/map-gen-settings.json"
|
||||
fi
|
||||
|
||||
if [[ ! -f $CONFIG/map-settings.json ]]; then
|
||||
cp /opt/factorio/data/map-settings.example.json "$CONFIG/map-settings.json"
|
||||
fi
|
||||
|
||||
# Clean up incomplete saves
|
||||
NRTMPSAVES=$( find -L "$SAVES" -iname \*.tmp.zip -mindepth 1 | wc -l )
|
||||
if [[ $NRTMPSAVES -gt 0 ]]; then
|
||||
rm -f "$SAVES"/*.tmp.zip
|
||||
fi
|
||||
|
||||
# Update mods if requested
|
||||
if [[ ${UPDATE_MODS_ON_START:-} == "true" ]]; then
|
||||
${INSTALLED_DIRECTORY}/docker-update-mods.sh
|
||||
fi
|
||||
|
||||
# Handle DLC
|
||||
${INSTALLED_DIRECTORY}/docker-dlc.sh
|
||||
|
||||
# In rootless mode, we don't need to handle user switching or chown
|
||||
# The container runs as the specified user from the start
|
||||
EXEC=""
|
||||
if [[ -f /bin/box64 ]]; then
|
||||
# Use emulator for ARM hosts
|
||||
EXEC="/bin/box64"
|
||||
fi
|
||||
|
||||
# Update config path
|
||||
sed -i '/write-data=/c\write-data=\/factorio/' /opt/factorio/config/config.ini
|
||||
|
||||
# Generate new save if needed
|
||||
NRSAVES=$(find -L "$SAVES" -iname \*.zip -mindepth 1 | wc -l)
|
||||
if [[ $GENERATE_NEW_SAVE != true && $NRSAVES == 0 ]]; then
|
||||
GENERATE_NEW_SAVE=true
|
||||
SAVE_NAME=_autosave1
|
||||
fi
|
||||
|
||||
if [[ $GENERATE_NEW_SAVE == true ]]; then
|
||||
if [[ -z "$SAVE_NAME" ]]; then
|
||||
echo "If \$GENERATE_NEW_SAVE is true, you must specify \$SAVE_NAME"
|
||||
exit 1
|
||||
fi
|
||||
if [[ -f "$SAVES/$SAVE_NAME.zip" ]]; then
|
||||
echo "Map $SAVES/$SAVE_NAME.zip already exists, skipping map generation"
|
||||
else
|
||||
if [[ ! -z "$PRESET" ]]; then
|
||||
$EXEC /opt/factorio/bin/x64/factorio \
|
||||
--create "$SAVES/$SAVE_NAME.zip" \
|
||||
--preset "$PRESET" \
|
||||
--map-gen-settings "$CONFIG/map-gen-settings.json" \
|
||||
--map-settings "$CONFIG/map-settings.json"
|
||||
else
|
||||
$EXEC /opt/factorio/bin/x64/factorio \
|
||||
--create "$SAVES/$SAVE_NAME.zip" \
|
||||
--map-gen-settings "$CONFIG/map-gen-settings.json" \
|
||||
--map-settings "$CONFIG/map-settings.json"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# Build command flags
|
||||
FLAGS=(\
|
||||
--port "$PORT" \
|
||||
--server-settings "$CONFIG/server-settings.json" \
|
||||
--server-banlist "$CONFIG/server-banlist.json" \
|
||||
--rcon-port "$RCON_PORT" \
|
||||
--server-whitelist "$CONFIG/server-whitelist.json" \
|
||||
--use-server-whitelist \
|
||||
--server-adminlist "$CONFIG/server-adminlist.json" \
|
||||
--rcon-password "$(cat "$CONFIG/rconpw")" \
|
||||
--server-id /factorio/config/server-id.json \
|
||||
--mod-directory "$MODS" \
|
||||
)
|
||||
|
||||
if [ -n "$CONSOLE_LOG_LOCATION" ]; then
|
||||
FLAGS+=( --console-log "$CONSOLE_LOG_LOCATION" )
|
||||
fi
|
||||
|
||||
if [ -n "$BIND" ]; then
|
||||
FLAGS+=( --bind "$BIND" )
|
||||
fi
|
||||
|
||||
if [[ $LOAD_LATEST_SAVE == true ]]; then
|
||||
FLAGS+=( --start-server-load-latest )
|
||||
else
|
||||
FLAGS+=( --start-server "$SAVE_NAME" )
|
||||
fi
|
||||
|
||||
# Execute factorio
|
||||
# In rootless mode, we run directly without user switching
|
||||
exec $EXEC /opt/factorio/bin/x64/factorio "${FLAGS[@]}" "$@"
|
||||
Reference in New Issue
Block a user