✨ run server with non-root user (#28)

* ✨ running server using non-root user

* 🔧 add shell exec script and doc

* 📝 small comment update in server config file

* 📝 updated server config doc

Dockerfile

@@ -1,12 +1,14 @@
+# Available build arguments and default configuration
+ARG COD2_VERSION="1_3"
+ARG LIBCOD_GIT_URL="https://github.com/voron00/libcod"
+# Choose in: [0 = mysql disables; 1 = default mysql; 2 = VoroN experimental mysql]
+ARG LIBCOD_MYSQL_TYPE=1
+
 # Throwaway build stage
 FROM debian:buster-20190708-slim AS build
-
-# Configuration
-ENV COD2_VER="1_3" \
-  LIB_NAME="libcod2" \
-  LIBCOD_GIT_URL="https://github.com/voron00/libcod" \
-  # Choose in: [0 = mysql disables; 1 = default mysql; 2 = VoroN experimental mysql]
-  LIBCOD_MYSQL_TYPE=1
+ARG COD2_VERSION
+ARG LIBCOD_GIT_URL
+ARG LIBCOD_MYSQL_TYPE
 
 # Add i386 architecture support
 RUN dpkg --add-architecture i386
@@ -24,14 +26,14 @@ RUN apt-get install -y --no-install-recommends default-libmysqlclient-dev:i386=1
 RUN apt-get install -y --no-install-recommends libsqlite3-dev:i386=3.27.2-3
 
 # Download libcod from "Voron00"
-RUN git clone ${LIBCOD_GIT_URL} ${TMPDIR}/${LIB_NAME}
+RUN git clone ${LIBCOD_GIT_URL} ${TMPDIR}/libcod2
 
 # Build libcod2
-WORKDIR ${TMPDIR}/${LIB_NAME}
-RUN yes ${LIBCOD_MYSQL_TYPE} | ./doit.sh cod2_${COD2_VER}
-RUN mv bin/libcod2_${COD2_VER}.so /lib/libcod2_${COD2_VER}.so
+WORKDIR ${TMPDIR}/libcod2
+RUN yes ${LIBCOD_MYSQL_TYPE} | ./doit.sh cod2_${COD2_VERSION}
+RUN mv bin/libcod2_${COD2_VERSION}.so /lib/libcod2_${COD2_VERSION}.so
 
-# Copy server binary and make it runable
+# Copy server binary and make it runnable
 COPY bin/cod2_lnxded_1_3_nodelay_va_loc /bin/cod2_lnxded
 RUN chmod +x /bin/cod2_lnxded
 
@@ -41,28 +43,32 @@ RUN chmod +x /entrypoint.sh
 
 # Runtime stage
 FROM alpine:3.11.6
-LABEL maintainer='bgauduch'
+ARG COD2_VERSION
+LABEL maintainer='bgauduch@github'
 
-# Copy needed libraries from build stage
-COPY --from=build /lib/i386-linux-gnu/ /lib/i386-linux-gnu/
+# Copy needed libraries and binaries from build stage
 COPY --from=build /usr/lib/i386-linux-gnu/ /usr/lib/i386-linux-gnu/
+COPY --from=build /lib/i386-linux-gnu/ /lib/i386-linux-gnu/
 COPY --from=build /lib/ld-linux.so.2 /lib/ld-linux.so.2
-COPY --from=build /lib/libcod2_1_3.so /lib/libcod2_1_3.so
-
-# Copy cod2 server binary from build stage
-COPY --from=build /bin/cod2_lnxded /server/cod2_lnxded
+COPY --from=build /lib/libcod2_${COD2_VERSION}.so /lib/libcod2_${COD2_VERSION}.so
+COPY --from=build /bin/cod2_lnxded /home/cod2/cod2_lnxded
 
 # Copy the entrypoint from build stage
 COPY --from=build /entrypoint.sh /entrypoint.sh
 
+# setup the server non-root user
+ENV SERVER_USER="cod2"
+RUN addgroup -S ${SERVER_USER} && adduser -S -D -G ${SERVER_USER} ${SERVER_USER}
+USER ${SERVER_USER}
+
 # Exposed server ports
 EXPOSE 20500/udp 20510/udp 28960/tcp 28960/udp
 
-# Set the server dir
-WORKDIR /server
-
 # Server "main" folder volume
-VOLUME [ "/server/main" ]
+VOLUME [ "/home/${SERVER_USER}/main" ]
+
+# Set the server dir
+WORKDIR /home/${SERVER_USER}
 
-# Launch server at container startup, using libcod library
+# Launch server at container startup
 ENTRYPOINT [ "/entrypoint.sh"]

README.md

@@ -74,6 +74,12 @@ You can use this script to display and follow the server logs:
 ./scripts/dev-logs.sh
 ```
 
+### Launch a shell in the container
+You can use this script to launch a shell in the running container:
+```sh
+./scripts/dev-exec.sh
+```
+
 ### Cleanup
 You can use this script to remove everything once your tests are over:
 ```sh

cod2server/main/config.cfg

@@ -44,7 +44,7 @@ set sv_maxrate "25000"
 // Pure on or Off: Pure is basicly an anticheat
 set sv_pure "1"
 
-// Disable console access from client
+// Disable rcon console access from client
 set sv_disableClientConsole "1"
 
 // Have the Server Show Up on GameSpy
@@ -185,7 +185,8 @@ set scr_sd_bombtimer "60"
 set scr_tdm_scorelimit "100"
 set scr_tdm_timelimit "15"
 
-// Set the Allowed Maps 
+// Set the map rotation and gametype
 set sv_maprotation "gametype tdm map mp_brecourt gametype ctf map mp_carentan gametype tdm map mp_farmhouse gametype ctf map mp_dawnville gametype tdm map mp_burgundy gametype ctf map mp_trainstation gametype tdm map mp_decoy gametype ctf map mp_toujane gametype tdm map mp_matmata gametype ctf map mp_railyard gametype tdm map mp_breakout gametype ctf map mp_leningrad gametype tdm map mp_downtown"
-// Rotate to launch the first map
+
+/ Rotate to launch the first map
 map_rotate

doc/readme.md

@@ -1,94 +1,97 @@
 # Call Of Duty 2 - server documentation
-Full credit goes to http://anarchyrules.co.uk/cod2/server%20commands.html 
+Full credit goes to http://anarchyrules.co.uk/cod2/server%20commands.html
+
+## Server config
+* `set fs_basepath`: set the game folder.
+* `set fs_homepath`: set the multiplayer log file and live config folder.
 
 ## Map Name
 All maps are available in each gamemodes:
-- DM: death match
-- TDM: team death match
-- SD: search & destroy
-- CTF: capture the flag
-- HQ: headquarter
+- `dm`: death match
+- `tdm`: team death match
+- `sd`: search & destroy
+- `ctf`: capture the flag
+- `hq`: headquarter
 
 Map name list:
-- mp_breakout
-- mp_brecourt
-- mp_burgundy
-- mp_carentan
-- mp_dawnville
-- mp_decoy
-- mp_downtown
-- mp_farmhouse
-- mp_leningrad
-- mp_matmata
-- mp_railyard
-- mp_toujane
-- mp_trainstation
+- `mp_breakout`
+- `mp_brecourt`
+- `mp_burgundy`
+- `mp_carentan`
+- `mp_dawnville`
+- `mp_decoy`
+- `mp_downtown`
+- `mp_farmhouse`
+- `mp_leningrad`
+- `mp_matmata`
+- `mp_railyard`
+- `mp_toujane`
+- `mp_trainstation`
 
 ## Console Commands
-
 Here are the available commands you can use in the server terminal.
 
-You can use commands in-game from the console: add the `/rcon` prefix and allow in-game console in server settings. Carreful not leaking your password when rcon login !
+You can use commands in-game from the console: add the `/rcon` prefix and allow in-game console in server configuration (`sv_disableClientConsole=0`).
 
 ### rcon
-* **/rcon login [rconpassword]**:
-Login to remote rcon. 
+* `/rcon login [rconpassword]`:
+Login to remote rcon. **Be carreful not leaking your password when using rcon login !**
 
 ### Common
-* **status**:
+* `status`:
 Displays info of all the players on the server.
-* **serverinfo**:
+* `serverinfo`:
 Shows the current server's settings.
-* **systeminfo**:
+* `systeminfo`:
 Shows the current system information.
-* **tell [id]**:
+* `tell [id]`:
 Sends private message to specified client id
-* **say**:
+* `say`:
 Broadcast a message to all players
-* **exec [FILENAME]**:
-Executes a Server Config File (located in your server's main directory) 
-* **writeconfig [FILENAME]**:
-Saves a Server Config File 
+* `exec [FILENAME]`:
+Executes a Server Config File (located in your server's main directory)
+* `writeconfig [FILENAME]`:
+Saves a Server Config File
 
 ### Gameplay
-* **matchtimeout**:
+* `matchtimeout`:
 Calls a match timeout (see server cvars for timeout settings)
-* **matchtimein**:
+* `matchtimein`:
 Cancels timeout
-* **setkillcam**:
+* `setkillcam`:
 Set the killcam cvar (now that it is read only during play)
-* **setfriendlyfire**:
+* `setfriendlyfire`:
 Set the friendly fire cvar (now that it is read only during play)
-* **setdrawfriend**:
+* `setdrawfriend`:
 Set the draw friend cvar (now that it is read only during play)
 
 
 ### Map commands
-* **map mapname**:
+* `map mapname`:
 Loads the map specified by mapname.
-* **map_rotate**:
+* `map_rotate`:
 Loads next map in rotation set in sv_maprotation.
-* **map_restart**:
+* `map_restart`:
 Restarts the map.
 
 ### Kick/ban Commands
-* **kick [name]**:
-Kicks a player by name from the server. (Must include Color Codes) 
-* **rcon onlykick [name]**: 
-Kicks a player by name from the server. (Does not need Color Codes) 
-* **clientkick [id]**:
+* `kick [name]`:
+Kicks a player by name from the server. (Must include Color Codes)
+* `rcon onlykick [name]`:
+Kicks a player by name from the server. (Does not need Color Codes)
+* `clientkick [id]`:
 Kicks a player by client id from the server.
-* **kick all**:
+* `kick all`:
 Kicks all players from server
-* **banUser [name]**:
+* `banUser [name]`:
 Bans a user by their ingame name. Writes their GUID to ban.txt
-* **banClient [id]**:
+* `banClient [id]`:
 Bans a user by their client number. Writes their GUID to ban.txt
-* **tempBanUser [name]**:
+* `tempBanUser [name]`:
 Kicks and temporarily bans player by name from server.
-* **tempBanClient [id]**:
+* `tempBanClient [id]`:
 Kicks and temporarily bans player by client id from server
-* **unban [name]**:
+* `unban [name]`:
 Unban every player banned with [name]. If you want to unban a single player whose name appears more than once, you should edit "ban.txt" manually.
 
 

docker-compose.yaml

@@ -8,5 +8,5 @@ services:
       - "28960:28960/tcp"
       - "28960:28960/udp"
     volumes:
-      - ./cod2server/main:/server/main:ro
+      - ./cod2server/main:/home/cod2/main:ro
     restart: unless-stopped

scripts/dev-exec.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+set -euo pipefail
+
+# execute a shell in the server service
+docker-compose exec cod2_server sh

scripts/entrypoint.sh

@@ -1,8 +1,9 @@
 #!/bin/sh
 set -euo pipefail
 
-# launch server 
-LD_PRELOAD="/lib/libcod2_1_3.so" /server/cod2_lnxded +set fs_basepath "/server" +set fs_homepath "/home" +exec config.cfg
+# launch server using libcod library
+LD_PRELOAD='/lib/libcod2_1_3.so' ./cod2_lnxded +exec config.cfg
+# +set fs_basepath "/server" +set fs_homepath "/server/home"
 
 # tail server logs in foreground
-# tail -f -n 50 /home/main/games_mp.log
+# tail -f -n 50 /home/main/games_mp.log