[Docker] Unable authenticate server in container

[Aranethon]

Give me some information about how you run docker

For example more information about your system, os and other device specific things.

Unraid 7.0.1 through Docker Web GUI

Problem Summary

Briefly describe what happens when you try to run the container (e.g., "The container exits immediately" or "Permission denied error").

Java process runs until it asks for authentication with /auth
The docker attach [container name] command does not result in a usable prompt.
When running ps while in the container console, the java process is not listed.

root@b163af80f0f9:/home/container# ps
    PID TTY          TIME CMD
    705 pts/0    00:00:00 sh
    711 pts/0    00:00:00 su
    712 pts/0    00:00:00 bash
    715 pts/0    00:00:00 ps

Log files

Please provide me with your complete log file in a .txt file

Pastebin

Docker setup

Please provide me with your docker compose file or docker run command

docker run
  -d
  --name='hytale-server'
  --entrypoint='/opt/unraid/tailscale'
  --net='br0'
  --ip='192.168.1.111'
  --pids-limit 2048
  --privileged=true
  -e TZ="America/Los_Angeles"
  -e HOST_OS="Unraid"
  -e HOST_HOSTNAME="Tower"
  -e HOST_CONTAINERNAME="hytale-server"
  -e 'TZ'='America/Vancouver'
  -e 'SERVER_IP'='0.0.0.0'
  -e 'SERVER_PORT'='5520'
  -e 'PROD'='FALSE'
  -e 'JAVA_ARGS'=''
  -e 'CACHE'='FALSE'
  -e 'HYTALE_ACCEPT_EARLY_PLUGINS'='TRUE'
  -e 'HYTALE_ALLOW_OP'='TRUE'
  -e 'HYTALE_AUTH_MODE'='FALSE'
  -e 'HYTALE_BACKUP'='FALSE'
  -e 'HYTALE_BACKUP_FREQUENCY'=''
  -e 'HYTALE_SERVER_NAME'='Allias Lads'
  -e 'HYTALE_MOTD'=''
  -e 'HYTALE_PASSWORD'=''
  -e 'HYTALE_MAX_VIEW_RADIUS'='32'
  -e 'HYTALE_COMPRESSION'='false'
  -e 'HYTALE_WORLD'='Kovalt'
  -e 'HYTALE_GAMEMODE'='Adventure'
  -e 'HYTALE_MAX_PLAYERS'='100'
  -e 'DEBUG'='FALSE'
  -e TAILSCALE_HOSTNAME='hytale-server'
  -e TAILSCALE_EXIT_NODE_IP='100.86.129.116'
  -e TAILSCALE_ALLOW_LAN_ACCESS='false'
  -e TAILSCALE_USE_SSH='false'
  -e TAILSCALE_USERSPACE_NETWORKING='false'
  -e TAILSCALE_STATE_DIR='/home/container/.tailscale_state'
  -e ORG_ENTRYPOINT="/usr/bin/tini
  --"
  -e ORG_CMD="/bin/sh /entrypoint.sh"
  -l net.unraid.docker.managed=dockerman
  -l net.unraid.docker.icon='https://hytale.com/static/images/logo-h.png'
  -l net.unraid.docker.tailscale.hostname='hytale-server'
  -v '/mnt/user/ryanshare/GameServers/HytaleServer':'/home/container':'rw'
  -v '/usr/local/share/docker/tailscale_container_hook':'/opt/unraid/tailscale'
  --device='/dev/net/tun'
  --cap-add=NET_ADMIN
  --user root 'deinfreu/hytale-server:experimental'

b163af80f0f98d8c0d5b361273181df1095d8ad050c5dacbca0503ec6cb23627

The command finished successfully!

PS: I'm aware I shouldn't be running it as root, but Tailscale throws a fit if I don't

[deinfreu]

Hi this is not an error this is good. Use the docs from the github page to authenticate your server.

[Aranethon]

The docker attach [container name] command not showing the > symbol, nor taking any commands is not an error?

[deinfreu]

Did it work out?

[Aranethon]

No, I still have no prompt after attaching to the docker. I can't pass the /auth command.

[arschgeige4]

i have the exact same issue, docker attach hytale-server gives me a cursor, i can type, but once i press enter, nothing happens, also nothing new in the logs

[Aranethon]

The A1M4N3 Hytale server offers a link to authenticate the server, similar to the step for the hytale-downloader.
Perhaps this could be implemented for this step as well?

[deinfreu]

He is only authenticating once I see. That is interesting I am checking this tomorrow if I can learn something from this. What is the user flow you want to get some inspiration from exactly. And can you explain it to me?

[Aranethon]

From using it, it seems to authenticate twice, but it uses the same method. Once for the download, once again for the server.
Your flow already does this for the Hytale-Downloader, but then wants the /auth command for the server.

Seeing as I can't properly get a java console prompt with my method of install, having the authorization link instead would be incredibly helpful.

Edit: The interaction in question starts from line 313 of their entrypoint.sh

[GuillaumeOuint]

For all of you, add in the compose service:

tty: true
stdin_open: true

Or -ti in a docker run command

[GuillaumeOuint]

Also, i'm running it in kubernetes and it can't save encrypted token (I don't know if it's the same on docker).
So either you have:

• To re-auth at each server start
• Develop or find a plugin to change the AuthCredentialStoreProvider used in the config (like I did, I developed a plugin that use mongo to save the tokens with hostname of container as an ID (I use StatefulSet so always stable hostname))

[Aranethon]

After looking over the example for docker run again, I found that adding the -t -i arguments to the extra parameters section of the Unraid container template gives the user access to the docker attach command in the Unraid console. I can use /auth with this.

However I do think the authorization flow for the other container should still be considered, to save users from having to worry about attaching to the container.

[GuillaumeOuint]

After looking over the example for docker run again, I found that adding the -t -i arguments to the extra parameters section of the Unraid container template gives the user access to the docker attach command in the Unraid console. I can use /auth with this.

However I do think the authorization flow for the other container should still be considered, to save users from having to worry about attaching to the container.

To avoid the use of /auth login device in the container with tty, it would imply to modify and re-distribute the HytaleServer.jar. Surely, this isn't something doable.
I only see one way, take the login flow from HytaleServer.jar into a custom app, create a plugin for a AuthCredentialProvider, and bridge the two, run that before the server. The custom app print a link, get the tokens, save it somewhere (file/database) then the plugin read it.

[Aranethon]

After looking over the example for docker run again, I found that adding the -t -i arguments to the extra parameters section of the Unraid container template gives the user access to the docker attach command in the Unraid console. I can use /auth with this.
However I do think the authorization flow for the other container should still be considered, to save users from having to worry about attaching to the container.

To avoid the use of /auth login device in the container with tty, it would imply to modify and re-distribute the HytaleServer.jar. Surely, this isn't something doable. I only see one way, take the login flow from HytaleServer.jar into a custom app, create a plugin for a AuthCredentialProvider, and bridge the two, run that before the server. The custom app print a link, get the tokens, save it somewhere (file/database) then the plugin read it.

Consider opening an enhancement issue with this, to keep this issue on topic, please