From 966e3ed6ce9b86a40d6b2faa76ad7d636793a50d Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 21 Oct 2026 17:18:15 +0000 Subject: [PATCH 1/6] fix(images): bump steamcmd ca-certificates to 20260816ubuntu0.26.04.1 Ubuntu 26.04 security update that distrusts "emSign ECC Root CA - G3" after the eMudhra intermediate key compromise (LP: #2171507), and updates the Mozilla bundle to 2.90. The previous pin is superseded. Co-Authored-By: Claude Haiku 5.5 Claude-Session: https://claude.ai/code/session_0167a62Kf9YPQSPmHzatt3RZ Signed-off-by: Claude --- containers/common/steamcmd/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/containers/common/steamcmd/Dockerfile b/containers/common/steamcmd/Dockerfile index 10424954f..7125ef7c0 100644 --- a/containers/common/steamcmd/Dockerfile +++ b/containers/common/steamcmd/Dockerfile @@ -60,7 +60,7 @@ ARG GAMESERVER_GID=10000 # install is idempotent and cheap either way, so it stays as a safety net — # `apt-get install` on an already-installed package is a no-op. RUN apt-get update && \ - apt-get install -y --no-install-recommends ca-certificates=20260601~26.04.1 && \ + apt-get install -y --no-install-recommends ca-certificates=20260816ubuntu0.26.04.1 && \ rm -rf /var/lib/apt/lists/* # Copy the shared installation helper script. From 2cad88284aa5d22f30dd80381dde7991c1eedabe Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 21 Oct 2026 17:34:00 +0000 Subject: [PATCH 2/6] fix(tunnel): bump tailscale to v1.104.2 v1.104.2 builds tailscaled with Go 1.27.3, which fixes the stdlib CVE-2026-78667, CVE-2026-97031 and CVE-2026-78669 (Go 1.27.2) and the eMudhra intermediate distrust CVE-2026-111943 (Go 1.27.3). golang.org/x/net is still v0.59.0 upstream, so CVE-2026-78669 stays flagged on x/net. Co-Authored-By: Claude Haiku 5.5 Signed-off-by: Claude --- tunnel/Dockerfile.tailscale | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tunnel/Dockerfile.tailscale b/tunnel/Dockerfile.tailscale index 21ad097a2..fba707762 100644 --- a/tunnel/Dockerfile.tailscale +++ b/tunnel/Dockerfile.tailscale @@ -27,7 +27,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build \ # Copy tailscale binaries from the official upstream image pinned by digest. # tailscale is distributed as official OCI images; pinning by digest # ensures reproducible builds. The image ships both tailscaled and tailscale CLI. -FROM tailscale/tailscale:v1.104.1@sha256:87c55d6be56ad85b3d8bceca5f87f73de288c609131460dd1be1874c250cc41d AS tailscale-stage +FROM tailscale/tailscale:v1.104.2@sha256:b11583ad2e93e4671128538c88cf11f460444a5d7e449311dd1933a400ab849d AS tailscale-stage FROM gcr.io/distroless/static:nonroot WORKDIR / From 0716ad814dcfdb95a1f45138dc32d6b4297377dc Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 21 Oct 2026 17:34:00 +0000 Subject: [PATCH 3/6] fix(images): move FiveM and BeamMP to Alpine 3.24 Alpine 3.20 is end of life and only carries ca-certificates 20260413-r0, which still trusts "emSign ECC Root CA - G3" after the eMudhra intermediate key compromise. ca-certificates 20261020-r0 (the distrust update) ships only in 3.24 and edge. Every apk pin moves to its 3.24 version; procps is packaged as procps-ng there. Co-Authored-By: Claude Haiku 5.5 Signed-off-by: Claude --- containers/games/beammp/Dockerfile | 16 ++++++++-------- containers/games/fivem/Dockerfile | 24 ++++++++++++------------ 2 files changed, 20 insertions(+), 20 deletions(-) diff --git a/containers/games/beammp/Dockerfile b/containers/games/beammp/Dockerfile index 96ea866a9..4d211af84 100644 --- a/containers/games/beammp/Dockerfile +++ b/containers/games/beammp/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.20 +FROM alpine:3.24 LABEL org.opencontainers.image.title="Gameplane BeamMP Dedicated Server" \ org.opencontainers.image.description="Dedicated server container for BeamNG.drive (BeamMP) with diagnostic idle support for missing auth keys" \ @@ -6,14 +6,14 @@ LABEL org.opencontainers.image.title="Gameplane BeamMP Dedicated Server" \ org.opencontainers.image.source="https://github.com/GameplanePanel/Gameplane" RUN apk add --no-cache \ - bash~=5.2.26 \ - curl~=8.14.1 \ - ca-certificates~=20260413 \ + bash~=5.3.9 \ + curl~=8.22.0 \ + ca-certificates~=20261020 \ tini~=0.19.0 \ - procps~=4.0.4 \ - libstdc++~=13.2.1_git20240309 \ - libgcc~=13.2.1_git20240309 \ - openssl~=3.3.7 \ + procps-ng~=4.0.6 \ + libstdc++~=15.2.0 \ + libgcc~=15.2.0 \ + openssl~=3.5.9 \ zlib~=1.3.2 # Create gameplane runtime user with fixed UID/GID 1000 diff --git a/containers/games/fivem/Dockerfile b/containers/games/fivem/Dockerfile index 5e5d149e3..ebfea74e2 100644 --- a/containers/games/fivem/Dockerfile +++ b/containers/games/fivem/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.20 +FROM alpine:3.24 LABEL org.opencontainers.image.title="Gameplane FiveM Dedicated Server" \ org.opencontainers.image.description="Dedicated server container for FiveM (GTA V MP) with txAdmin and embedded database supervision" \ @@ -6,18 +6,18 @@ LABEL org.opencontainers.image.title="Gameplane FiveM Dedicated Server" \ org.opencontainers.image.source="https://github.com/GameplanePanel/Gameplane" RUN apk add --no-cache \ - bash~=5.2.26 \ - curl~=8.14.1 \ - ca-certificates~=20260413 \ + bash~=5.3.9 \ + curl~=8.22.0 \ + ca-certificates~=20261020 \ tini~=0.19.0 \ - procps~=4.0.4 \ - libstdc++~=13.2.1_git20240309 \ - libgcc~=13.2.1_git20240309 \ - icu-libs~=74.2 \ - mariadb~=10.11.18 \ - mariadb-client~=10.11.18 \ - sqlite~=3.45.3 \ - tzdata~=2026b + procps-ng~=4.0.6 \ + libstdc++~=15.2.0 \ + libgcc~=15.2.0 \ + icu-libs~=78.1 \ + mariadb~=11.8.9 \ + mariadb-client~=11.8.9 \ + sqlite~=3.53.4 \ + tzdata~=2026e # Create gameplane runtime user with fixed UID/GID 1000 RUN addgroup -g 1000 gameplane && \ From 4468e090c7131ad2b28b9c94de7b93113b8f99af Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 21 Oct 2026 17:39:39 +0000 Subject: [PATCH 4/6] fix(images): run mariadb-upgrade in FiveM entrypoint The Alpine 3.24 base moves the embedded MariaDB from 10.11 to 11.8, and existing /server-data/mysql system tables stay on the 10.11 layout. Run mariadb-upgrade once the socket is up (no-op on current data, failure only logged) and install mariadb-server-utils, which ships it on Alpine. Co-Authored-By: Claude Haiku 5.5 Signed-off-by: Claude --- containers/games/fivem/Dockerfile | 1 + containers/games/fivem/entrypoint.sh | 8 ++++++++ 2 files changed, 9 insertions(+) diff --git a/containers/games/fivem/Dockerfile b/containers/games/fivem/Dockerfile index ebfea74e2..cb01f276d 100644 --- a/containers/games/fivem/Dockerfile +++ b/containers/games/fivem/Dockerfile @@ -16,6 +16,7 @@ RUN apk add --no-cache \ icu-libs~=78.1 \ mariadb~=11.8.9 \ mariadb-client~=11.8.9 \ + mariadb-server-utils~=11.8.9 \ sqlite~=3.53.4 \ tzdata~=2026e diff --git a/containers/games/fivem/entrypoint.sh b/containers/games/fivem/entrypoint.sh index e5cce04f3..2dffe77e5 100755 --- a/containers/games/fivem/entrypoint.sh +++ b/containers/games/fivem/entrypoint.sh @@ -70,6 +70,14 @@ if [ "${ENABLE_EMBEDDED_DB:-true}" = "true" ]; then fi sleep 0.5 done + # A MariaDB major upgrade (10.11 -> 11.8 with the Alpine 3.24 base) leaves + # existing system tables on the old layout. mariadb-upgrade brings them + # current and is a no-op when they already are. mysql_install_db --user + # created gameplane@localhost with unix_socket auth, matching uid 1000. + if [ -S /tmp/mysql.sock ]; then + mariadb-upgrade --socket=/tmp/mysql.sock --user=gameplane >/dev/null 2>&1 \ + || echo "[gameplane-fivem] mariadb-upgrade failed; continuing with existing system tables" + fi fi # Ensure txAdmin data directory exists From 49b79019eb2b330a88bfdb92e32adb28feab23cd Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 21 Oct 2026 20:30:56 +0000 Subject: [PATCH 5/6] fix(images): bump Debian ca-certificates pin to 20250419~deb12u2 bookworm-security replaced 20250419~deb12u1 with 20250419~deb12u2 (DSA-6572, Debian #1151413), which blacklists "emSign ECC Root CA - G3" after the eMudhra intermediate key compromise. The old pin no longer resolves, so the Euro Truck Simulator 2 build failed with "Version '20250419~deb12u1' for 'ca-certificates' was not found". Co-Authored-By: Claude Haiku 5.5 Signed-off-by: Claude --- containers/games/euro-truck-simulator-2/Dockerfile | 2 +- containers/games/farming-simulator-25/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/containers/games/euro-truck-simulator-2/Dockerfile b/containers/games/euro-truck-simulator-2/Dockerfile index 08c6c17b0..650472958 100644 --- a/containers/games/euro-truck-simulator-2/Dockerfile +++ b/containers/games/euro-truck-simulator-2/Dockerfile @@ -12,7 +12,7 @@ RUN dpkg --add-architecture i386 && \ apt-get install -y --no-install-recommends \ bash=5.2.15-2+b13 \ curl=7.88.1-10+deb12u15 \ - ca-certificates=20250419~deb12u1 \ + ca-certificates=20250419~deb12u2 \ tini=0.19.0-1+b3 \ procps=2:4.0.2-3 \ lib32gcc-s1=12.2.0-14+deb12u1 \ diff --git a/containers/games/farming-simulator-25/Dockerfile b/containers/games/farming-simulator-25/Dockerfile index 25c5db43d..07ca61c09 100644 --- a/containers/games/farming-simulator-25/Dockerfile +++ b/containers/games/farming-simulator-25/Dockerfile @@ -12,7 +12,7 @@ RUN dpkg --add-architecture i386 && \ apt-get install -y --no-install-recommends \ bash=5.2.15-2+b13 \ curl=7.88.1-10+deb12u15 \ - ca-certificates=20250419~deb12u1 \ + ca-certificates=20250419~deb12u2 \ tini=0.19.0-1+b3 \ procps=2:4.0.2-3 \ xvfb=2:21.1.7-3+deb12u13 \ From 2d4e57a5eb5b95cad2852a1f1f82668b7f4f1d9b Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 21 Oct 2026 20:37:01 +0000 Subject: [PATCH 6/6] fix(images): retry FiveM mariadb-upgrade and update tailscale version doc Address CodeRabbit review on #775: - The MariaDB socket can exist before authenticated connections work, so retry mariadb-upgrade up to 10 times (1s apart) before logging failure. Startup still continues after a final failure. - tunnel/specs.md said the flags were confirmed against tailscale v1.102.4. Dockerfile.tailscale now ships v1.104.2; the documented tailscale/tailscaled flags (up --reset/--auth-key/--hostname/--advertise-tags, status --json/--peers, --socket; tailscaled -config/-state/-socket) were checked against the v1.104.2 binaries, and tailscale set still has no --advertise-tags. Co-Authored-By: Claude Haiku 5.5 Signed-off-by: Claude --- containers/games/fivem/entrypoint.sh | 15 +++++++++++++-- tunnel/specs.md | 2 +- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/containers/games/fivem/entrypoint.sh b/containers/games/fivem/entrypoint.sh index 2dffe77e5..7787baa10 100755 --- a/containers/games/fivem/entrypoint.sh +++ b/containers/games/fivem/entrypoint.sh @@ -74,9 +74,20 @@ if [ "${ENABLE_EMBEDDED_DB:-true}" = "true" ]; then # existing system tables on the old layout. mariadb-upgrade brings them # current and is a no-op when they already are. mysql_install_db --user # created gameplane@localhost with unix_socket auth, matching uid 1000. + # The socket can appear before MariaDB accepts authenticated connections, + # so retry briefly. A final failure only logs: the next start retries it. if [ -S /tmp/mysql.sock ]; then - mariadb-upgrade --socket=/tmp/mysql.sock --user=gameplane >/dev/null 2>&1 \ - || echo "[gameplane-fivem] mariadb-upgrade failed; continuing with existing system tables" + upgraded=false + for i in $(seq 1 10); do + if mariadb-upgrade --socket=/tmp/mysql.sock --user=gameplane >/dev/null 2>&1; then + upgraded=true + break + fi + sleep 1 + done + if [ "$upgraded" != true ]; then + echo "[gameplane-fivem] mariadb-upgrade failed after 10 attempts; continuing with existing system tables" + fi fi fi diff --git a/tunnel/specs.md b/tunnel/specs.md index 810da868a..872ced694 100644 --- a/tunnel/specs.md +++ b/tunnel/specs.md @@ -114,7 +114,7 @@ playit.gg assigns a tunnel's public address server-side, so the supervisor learn ### Tailscale Tag Application -Tailscale ACL tags can only be requested when a device registers. tailscaled's declarative `--config` file has no field for them (see the `TAILSCALE_TAGS` row above). `tailscale set` has no `--advertise-tags` flag, and changing the tags of a registered node needs a fresh login. So when `TAILSCALE_TAGS` holds valid tags, the supervisor lets tailscaled start unauthenticated and registers it itself. Flags below are confirmed against tailscale v1.102.4, the version `Dockerfile.tailscale` ships. +Tailscale ACL tags can only be requested when a device registers. tailscaled's declarative `--config` file has no field for them (see the `TAILSCALE_TAGS` row above). `tailscale set` has no `--advertise-tags` flag, and changing the tags of a registered node needs a fresh login. So when `TAILSCALE_TAGS` holds valid tags, the supervisor lets tailscaled start unauthenticated and registers it itself. Flags below are confirmed against tailscale v1.104.2, the version `Dockerfile.tailscale` ships. 1. `renderTailscaleConfig` writes the config with `version`, `hostname` and `"locked": false`, and no `authKey`. The auth key goes to `/tmp/gameplane-tunnel-tailscale-authkey` (mode 0600). `locked` must be false: `ipn.ConfigVAlpha.Locked` defaults to true, and a locked config makes tailscaled reject every CLI prefs change. 2. `tailscaled` is started as usual, with `--socket=/tmp/gameplane-tunnel-tailscaled.sock`. Its Linux default, `/run/tailscale/tailscaled.sock`, can't be created by the non-root distroless image; this is the same reasoning as `playitSocketPath`. The `tailscale` CLI, bundled in `Dockerfile.tailscale` alongside `tailscaled`, reaches it over the same socket via `--socket=`. With no auth key, tailscaled waits in `NeedsLogin`.