minecraft/dockerfiles/Dockerfile.paper

FROM "${JRE_IMAGE:-localhost/minecraft-jre}":"${JRE_TAG:-latest}"

# Minecraft version to download
ARG VERSION=latest

# Plugins prefix
ARG PREFIX="PLUGIN_"

# PaperMC base URL
ARG BASE_URL="https://api.papermc.io/v2/projects/paper/versions/${VERSION}"

# Consider turning bStats (https://bStats.org) on but I'm turning it off by
# default because it collects information
ARG BSTATS_ENABLED=false

# Download files
USER root
WORKDIR /app

# Download and verify sha256sum for PaperMC server.jar
RUN set -eux && \
  # Grab latest version if not specified
  if [ "$VERSION" = "latest" ]; then \
    VERSION="$( \
      curl -s https://api.papermc.io/v2/projects/paper | \
        jq -r '.versions[-1]' \
    )"; \
  fi && \
  # Get latest build for the specified version
  BUILD="$( \
    curl -s "$BASE_URL" \
      | jq -r '.builds[-1]' \
  )" && \
  URL="${BASE_URL}/builds/${BUILD}/downloads/paper-${VERSION}-${BUILD}.jar" && \
  curl -s -o /tmp/server.jar "$URL" && \
  # Get SHA256 hash of server.jar and compare
  SHA256="$(sha256sum /tmp/server.jar | awk '{print $1}')" && \
  EXPECTED="$( \
    curl -s "$BASE_URL/builds/$BUILD" \
      | jq -r '.downloads.application.sha256' \
  )" && \
  if [ ! "$SHA256" = "$EXPECTED" ]; then \
    echo "[ERROR] SHA256=\"$SHA256\" expected \"$EXPECTED\""; \
    exit 1; \
  fi && \
  mv /tmp/server.jar /app/server.jar

# Move into a directory just for storing plugins
WORKDIR /app/plugins

# Copy in plugins
COPY ../plugins.json /app/plugins

# Download defined plugins
RUN set -eux && \
  # Download defined plugins and check against hash
  tmp_downloads="$(mktemp -d)" && \
  # Iterate over all plugins in plugins.json
  jq -c '.plugins[]' plugins.json | while read -r PLUGIN; do \
    # Set variables from plugins.json
    name=$(echo "$PLUGIN" | jq -r '.name') && \
    version=$(echo "$PLUGIN" | jq -r '.version') &&  \
    # Interpolate instances of '${version}' in the URL
    url=$(echo "$PLUGIN" | jq -r '.url' | sed "s/\${version}/$version/g") && \
    hash=$(echo "$PLUGIN" | jq -r '.hash') &&  \
    info=$(echo "$PLUGIN" | jq -r '.info_url') && \
    # Extract hash type and value, e.g., `md5:6f5902ac237024bdd0c176cb93063dc4`
    hash_type=$(echo "$hash" | cut -d':' -f1) && \
    hash_value=$(echo "$hash" | cut -d':' -f2-) && \
    # Download and compare the hash
    tmp_file="${tmp_downloads}/${name}-${version}.jar" && \
    curl -s -L "$url" -o "${tmp_file}" && \
    case "$hash_type" in \
      sha256) \
        echo "${hash_value}  $tmp_file" | sha256sum -c - || { \
          echo "SHA256 hash mismatch for ${name}-${version}.jar"; \
          rm -rf "$tmp_downloads"; \
          exit 1; \
        } \
        ;; \
      md5) \
        echo "${hash_value}  $tmp_file" | md5sum -c - || { \
          echo "MD5 hash mismatch for ${name}-${version}.jar"; \
          rm -rf "$tmp_downloads"; \
          exit 1; \
        } \
        ;; \
      *) \
        echo "Unsupported hash type: ${hash_type}"; \
        rm -rf "$tmp_downloads"; \
        exit 1; \
        ;; \
    esac && \
    mv "$tmp_file" "${name}-${version}.jar"; \
  done && \
  rm -rf "$tmp_downloads" && \
  chown minecraft:minecraft /app/plugins/

# Generate initial settings
USER minecraft
WORKDIR /app
RUN java -jar server.jar --initSettings --nogui && \
  # Disable bStats by default
  if [ "$BSTATS_ENABLED" = "false" ]; then \
    mkdir -p /app/plugins/bStats/ && \
    echo "enabled: false" > /app/plugins/bStats/config.yml; \
  fi

# Back to root to copy the entrypoint in
USER root
COPY ../entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/entrypoint.sh

# Run app as minecraft user
USER minecraft
WORKDIR /app

# Expose port and run entrypoint script
EXPOSE 25565
ENTRYPOINT ["entrypoint.sh"]