Modernize and harden dedicated server container (SteamCMD reliability, unprivileged runtime, systemd)

[johnseth97]

Summary

Modernizes and hardens this fork of Pleut/abiotic-factor-linux-docker for a private, systemd-supervised deployment: the game server no longer runs as root, SteamCMD installs/updates are retried and verified against the actual installed build ID rather than trusted on exit code alone, updates are staged and never risk save data, there's a real health check, graceful shutdown, backup/restore tooling, and a systemd unit + installer for boot-time supervision.

Verified directly against the live Steam depot for App ID 2857200 rather than assuming the old entrypoint's executable path/launch arguments still apply (they had drifted - see docs/upstream-review.md).

Upstream issues and PRs addressed

Full accounting with adopt/reject rationale in docs/upstream-review.md. Highlights:

• Server runs as root Pleut/abiotic-factor-linux-docker#18 (server runs as root) - fixed: unprivileged abiotic user, configurable PUID/PGID.
• Password enforced even though there isn't a password assigned to the servers compose Pleut/abiotic-factor-linux-docker#28/Password enforced even though there isn't a password assigned to the servers compose Pleut/abiotic-factor-linux-docker#29 (password enforced despite empty) - fixed: ${VAR:-default} bug in the old entrypoint that ignored an intentionally-empty password.
• No longer updates to the latest version Pleut/abiotic-factor-linux-docker#27/"Outdated Server" error on clients after patch 1.1 Pleut/abiotic-factor-linux-docker#24/After 0.8.2 We get "outdated client" error message Pleut/abiotic-factor-linux-docker#8 (stale/outdated server despite AutoUpdate) - fixed: updates are verified by comparing installed vs. latest build ID, never trusted from SteamCMD's exit code alone.
• Every restart shows server as 'corrupt' and cannot load from backup. [SOLVED] Pleut/abiotic-factor-linux-docker#20 (save corruption after restart) - addressed: graceful SIGTERM-based shutdown with a real grace period instead of a hard kill, plus consistent bind-mount ownership.
• PR Retry steamcmd install up to 5 times if server executable is not found. Pleut/abiotic-factor-linux-docker#26 (retry SteamCMD) - adopted the idea, reimplemented with bounded exponential backoff and executable-presence verification instead of an immediate-retry loop.
• PR Add locales en-US.UTF-8 to prevent unexpected warnings Pleut/abiotic-factor-linux-docker#25 (UTF-8 locale) - adopted as-is.
• PR Handle state is 0x6 when updating server binaries Pleut/abiotic-factor-linux-docker#23 (state 0x6 handling) - adopted the idea, reimplemented as a staged install (temp dir, verify, promote) instead of find -delete against the live install directory.
• PR Added Discord Webhook Integration for Session Code Pleut/abiotic-factor-linux-docker#14/Add Discord Webhook Integration for Session Codes Pleut/abiotic-factor-linux-docker#13/Add Discord Webhook Integration for Invite Code Pleut/abiotic-factor-linux-docker#12 (Discord webhook) - rejected as out of scope for a hardening pass; also repointed the image at an unrelated personal registry.

Security changes

• Game server, Wine, and SteamCMD all run as an unprivileged user (abiotic, configurable PUID/PGID, default 10000:10000) - never UID 0.
• Container is not privileged, does not mount the Docker socket, drops all Linux capabilities and adds back only the four required for the entrypoint's brief root-phase bootstrap (CHOWN, SETUID, SETGID, DAC_OVERRIDE - see docker-compose.yml for why), and sets no-new-privileges:true.
• SteamCMD authenticates anonymously; no Steam credentials are stored anywhere.
• .env (real secrets) is git-ignored; .env.example ships only placeholders, and the entrypoint refuses to start if SERVER_PASSWORD is still the placeholder.

Update strategy

Staged, verified, never destructive - see docs/operations.md "Update strategy in detail" for the full reasoning, including why a true atomic directory swap was rejected (saves are bind-mounted at nested paths inside the install directory). Short version: install/update into a disposable staging directory, verify the executable is actually present, rsync into the live directory excluding the save tree, re-verify. Failed updates leave the previous working installation untouched.

Test evidence

• docker compose config - clean.
• shellcheck entrypoint.sh scripts/*.sh - clean (via koalaman/shellcheck container image, since dnf install shellcheck wasn't available without an interactive sudo password).
• docker compose build --no-cache - succeeds; verified no secrets in image layers/history, entrypoint scripts executable, final process model runs unprivileged.
• systemd-analyze verify on all three unit files - clean.
• Fresh-install testing against real temporary runtime directories on the target host uncovered and fixed three real bugs before they'd have hit production:
  • Compose init: true + a baked-in tini ENTRYPOINT fighting each other (removed the redundant one).
  • cap_drop: ALL also stripping capabilities from the container's root user, breaking the entrypoint's own privilege-drop bootstrap (fixed with a minimal cap_add).
  • Valve's official steamcmd tarball shipping steamcmd.sh without execute permission for non-owner users (fixed with an explicit chmod in the Dockerfile).
• SELinux: confirmed directly on this host that bind-mounting runtime/ without :Z causes SteamCMD to report a successful install while writing nothing to the host directory - a silent AVC denial, not a SteamCMD bug. Fixed and verified with a full real install completing end-to-end with :Z in place.

Known limitations

• The CI workflow (.github/workflows/ci.yml) is not included in this PR yet. The gh token used to push this branch has repo/read:org/gist scopes but not workflow, which GitHub requires for any push that touches .github/workflows/*. The file is written and ready (shellcheck/compose-config/build-only, actions pinned to SHAs) - either run gh auth refresh -h github.com -s workflow and I'll push it as a follow-up commit, or add it manually via the GitHub web UI from the copy in this fork's working tree.
• A live end-to-end install/Wine-launch verification is not yet confirmed as of this PR - testing repeatedly hit a currently-ongoing SteamCMD self-update bootstrap failure against Valve's CDN (steamcmd_public_all/steamcmd_linux packages failing checksum/truncation, independent of the actual game depot), reproduced consistently over roughly 30 minutes of testing from this network, including via manual SteamCMD invocations outside this project's code entirely. The entrypoint's retry/backoff and stuck-cache-clearing logic behave correctly and fail safely and clearly (bounded retries, distinct exit code, no partial/corrupt state left in gamefiles, no impact on save data) - see docs/upstream-review.md for the reproduction details. Re-run the fresh-install test once this clears; exact command in docs/operations.md.
• No RCON/console save-and-shutdown command exists for this dedicated server (checked the official launch-parameters wiki); graceful shutdown relies on SIGTERM + a grace period. Documented, not papered over.
• CI does not attempt to launch the full game server (multi-GB SteamCMD download + Wine startup is unreliable/slow in Actions); the fresh-install test is a manual/host-level step, documented in docs/operations.md.

Deployment instructions

See README.md "Fedora installation" through "systemd commands" for the full walkthrough. Short version:

sudo mkdir -p /srv/abiotic-factor && sudo chown "$USER":"$USER" /srv/abiotic-factor
git clone <fork-url> /srv/abiotic-factor/repo
cd /srv/abiotic-factor/repo
cp .env.example /srv/abiotic-factor/.env && "$EDITOR" /srv/abiotic-factor/.env
sudo scripts/install-systemd.sh --start

Rollback instructions

sudo systemctl stop abiotic-factor.service
cd /srv/abiotic-factor/repo
git checkout <previous-commit-or-tag>
sudo systemctl start abiotic-factor.service

Data rollback: restore from runtime/backups/*.tar.gz per README.md "Backup and restore" (service must be stopped first).