[2.8.0.4] Minecraft isolation has empty /etc/resolv.conf on Debian 13, causing authentication failure

[Thovestad]

Operating System

Debian 13.6

AMP Version and Build Date

2.8.0.4 - 20260724.1

AMP Release Stream

Mainline

I confirm that

• I have searched for an existing bug report for this issue.
• I am using the latest available version of AMP.
• my operating system is up-to-date.

Intended Action

AMP should start the Minecraft server inside its isolated environment with working DNS resolution.

The isolated game process should have access to a valid /etc/resolv.conf, either by inheriting, copying, bind-mounting, or otherwise providing the host's resolver configuration.

In this case, the host resolver is:

domain localdomain
nameserver 1.1.1.1
nameserver 8.8.8.8

The Minecraft process should therefore be able to resolve endpoints such as:

api.minecraftservices.com
sessionserver.mojang.com

and Mojang/Microsoft authentication should work normally with online-mode=true.

Expected Behaviour

After AMP starts the Minecraft server, the isolated process should see a populated resolver configuration.

For example:

PID=$(pgrep -u amp -f 'unix_args.txt' | head -n1)

nsenter -t "$PID" -m -- cat /etc/resolv.conf

should return a valid resolver configuration similar to:

domain localdomain
nameserver 1.1.1.1
nameserver 8.8.8.8

DNS lookups from inside the same mount and network namespaces should work:

nsenter -t "$PID" -m -n --
getent ahosts api.minecraftservices.com

and should return a valid address.

Minecraft should consequently be able to retrieve the Yggdrasil public keys from:

https://api.minecraftservices.com/publickeys

without generating UnknownHostException.

Actual Behaviour

Environment:

AMP Instance Manager v2.8.0.4
Stream: Mainline / Release
Build date: 24/07/2026 17:14

Debian GNU/Linux 13.6 (trixie)

Minecraft Java Edition
All The Mods 10
NeoForge 21.1.247
Eclipse Temurin Java 21.0.12
Authlib 6.0.54

The host itself has working DNS and Internet connectivity.

Host /etc/resolv.conf:

Generated by dhcpcd from ens18.dhcp

domain localdomain
nameserver 1.1.1.1
nameserver 8.8.8.8

The Minecraft services endpoint is reachable directly from the host:

curl -4 -i https://api.minecraftservices.com/publickeys

returns:

HTTP/2 200
content-type: application/json

However, the Minecraft process runs in a separate mount namespace:

readlink /proc/1/ns/mnt
readlink /proc/$PID/ns/mnt

Output:

Host:
mnt:[4026531841]

Minecraft:
mnt:[4026532312]

Inside the Minecraft mount namespace:

nsenter -t "$PID" -m -- cat /etc/resolv.conf

returns no output.

/etc/resolv.conf exists but is empty.

DNS resolution consequently fails from inside the Minecraft mount/network namespaces:

nsenter -t "$PID" -m -n --
getent ahosts api.minecraftservices.com

returns no result.

Minecraft then logs:

[Yggdrasil Key Fetcher/ERROR]
Failed to request yggdrasil public key

com.mojang.authlib.exceptions.MinecraftClientException:
Failed to read from https://api.minecraftservices.com/publickeys
due to api.minecraftservices.com

Caused by:
java.net.UnknownHostException: api.minecraftservices.com

Clients receive:

Authentication servers are down. Please try again later, sorry!

Entering only the Minecraft network namespace does not reproduce the issue.

For example:

nsenter -t "$PID" -n curl -4
https://api.minecraftservices.com/publickeys

works.

Java DNS resolution also works when using the same network namespace without entering the Minecraft mount namespace:

java.net.InetAddress.getAllByName("api.minecraftservices.com")

returns:

[api.minecraftservices.com/150.171.109.34]

This indicates that the problem is specifically related to the isolated mount/filesystem namespace and its empty /etc/resolv.conf, rather than the network namespace, Java runtime, external DNS service, or Mojang/Microsoft services.

Reproduction

1. Start the Minecraft server normally through AMP.
2. Obtain the Minecraft Java process PID:

PID=$(pgrep -u amp -f 'unix_args.txt' | head -n1)

3. Confirm that the Minecraft process uses a separate mount namespace:

readlink /proc/1/ns/mnt
readlink /proc/$PID/ns/mnt

Example:

mnt:[4026531841]
mnt:[4026532312]

4. Check the host resolver:

cat /etc/resolv.conf

Example:

domain localdomain
nameserver 1.1.1.1
nameserver 8.8.8.8

5. Check the resolver from inside the Minecraft mount namespace:

nsenter -t "$PID" -m -- cat /etc/resolv.conf

Result:

6. Test DNS resolution inside both the Minecraft mount and network namespaces:

nsenter -t "$PID" -m -n --
getent ahosts api.minecraftservices.com

Result:

7. Minecraft logs then show:

java.net.UnknownHostException: api.minecraftservices.com

and clients cannot authenticate.

8. Apply the following workaround:

cat /etc/resolv.conf > /proc/$PID/root/etc/resolv.conf

9. Re-run:

nsenter -t "$PID" -m -n --
getent ahosts api.minecraftservices.com

DNS resolution now works.

10. Minecraft authentication immediately starts working again and players can join without any other Minecraft configuration changes.

The workaround therefore directly confirms that the empty /etc/resolv.conf inside the isolated Minecraft filesystem is the cause of the authentication failure.