Repository navigation
Fix the game start with docker-compose 1.29; ship worlds with god locked - #3
Merged
Merged
Conversation
God's password opens every nation, and the game keeps only the first seven
characters of a DES crypt (two of them the fixed salt), so the hash in a
published world can be guessed back. conqpasswd gains -l, which stores a
value no crypt() output can match ("*LOCKED"), and -q, which tells
whether a nation's password is locked (exit 3). The default and practice
worlds of the repository now have god locked; nations, the trainee
included, are unchanged, and the game's own builder still works for the
administrator.
The server sets its own: deploy-to-vps.sh and new-season.sh ask for it,
set-nation-password.sh god --if-locked asks only while none is set,
update-vps.sh and the container log warn while it is missing. CI checks
the shipped world is locked and conqpasswd -l/-q.
The VPS runs Debian's docker-compose 1.29, which hands ${VARIABLES} to
Docker as strings; Docker refused pids_limit: "512" and the game did not
start after the hardening. The limits are literal again (512 processes,
1g), and a test keeps numeric settings literal in both compose files.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix: the game container did not start on the VPS after the hardening in #1. Debian's
docker-compose1.29 hands${VARIABLES}to Docker as strings, and Docker refusedpids_limit: "512"(TypeError: Invalid type for pids_limit param: expected int). The limits are literal again (512 processes, 1g) in both compose files, andtests/test_compose.pykeeps numeric settings literal. CI did not catch it because it runs Compose v2, which converts the type.God's password locked in the shipped worlds. God's password opens every nation, and the game keeps only the first seven characters of a DES crypt (two of them the fixed salt), so the hash in a published world can be guessed back.
conqpasswd -l NATIONstores a value nocrypt()output can match (*LOCKED);conqpasswd -q NATIONexits 3 while it is locked.conquer/libandconquer/practice-worldnow ship with god locked; the nations (traineeincluded) are unchanged, and the administrator's builder still works.deploy-to-vps.shandnew-season.shask for it,set-nation-password.sh god --if-lockedasks only while none is set,update-vps.shand the container log warn while it is missing../set-nation-password.sh god.Testing
*LOCKEDincluded) opens it; after setting one, only that one does; other nations are unaffected. The nation builder test passes with the locked world.docker-compose1.29 renders the VPS file with integer limits; the new test fails on the previous files and passes now.conqpasswd -land-qwork.Deploying
On the VPS, undo the hand fix first, then update:
🤖 Generated with Claude Code
https://claude.ai/code/session_012PbWLvRqPFczMuZwP12Gte
Generated by Claude Code