Add support for Pelican's opinionated Docker CE setup

[cowrevenge]

Pelican-specific fixes (enable with PELICANFIX=1|true|True)

if [[ "${PELICANFIX}" =~ ^(1|true|True)$ ]]; then
export HOME="/home/container"
export STEAMAPPDIR="${HOME}/Steam"
INSTALL_DIR="${STEAMAPPDIR}/cs2-dedicated"

echo "Pelicanfix enabled"
echo "[PELICANFIX] HOME=${HOME}"
echo "[PELICANFIX] STEAMAPPDIR=${STEAMAPPDIR}"
echo "[PELICANFIX] INSTALL_DIR=${INSTALL_DIR}"
echo "[PELICANFIX] uid=$(id -u) gid=$(id -g)"

Minimal scaffolding only

mkdir -p "${INSTALL_DIR}" "${STEAMAPPDIR}/logs"
"${HOME}/steamapps" "${HOME}/.steam/sdk32" "${HOME}/.steam/sdk64"
ln -sfn "../steamapps" "${STEAMAPPDIR}/steamapps" || true

Sanity checks

[ -d "${INSTALL_DIR}" ] || { echo "[PELICANFIX] ERROR: ${INSTALL_DIR} missing"; exit 1; }
[ -w "${INSTALL_DIR}" ] || { echo "[PELICANFIX] ERROR: ${INSTALL_DIR} not writable"; ls -ld "${INSTALL_DIR}"; exit 1; }

Run from install dir

cd "${INSTALL_DIR}"

Redirect stderr to Steam logs

exec 2> "${STEAMAPPDIR}/logs/stderr.txt"
echo "[PELICANFIX] stderr -> ${STEAMAPPDIR}/logs/stderr.txt"
fi

[cowrevenge]

I forked your repo and placed this in entry.sh . Still in testing and would gladly accept better fixes.

[joedwards32]

Thank you for your contribution, @cowrevenge.

Can you explain the issue you are trying to fix for me? I haven't use Pelican before, though I am pretty familiar with the common container runtimes (docker-engine, containerd, podman).

As a rule of thumb, the isolation between container and host means that the container image shouldn't need to be modified for any specific host environment. Having Pelican specific fixes in the entry script suggests we have strayed from the path.

We may be able to address your problems with documentation, rather than changes to the code.

Give me a fuller problem statement when you have the time :)

[cowrevenge]

Pelican prevents setting HOME as a rule, and only allowed changes in the distro. Its the same write error you already have a fix for in the entry but that fix wasn't working until I redefined home in the entre as above. I saw other VM have similar problems that are fixed by setting home like this.

No amount of export Home = , makes any difference in the install script.

Without this the log for example tried printing to "//" . And then fails the install due to no permission to write to root

[joedwards32]

Yes, but you are describing user/home configuration in the host's /etc/passwd file. No?

The layout within the container shouldn't matter to the host, in an OCI-compliant runtime.

Pelican looks easy enough to setup. I'll spin up a lab and give it a go.

[cowrevenge]

ghcr.io/cowrevenge/pelican_cs2:latest <- patched distro is here

Here is the error

the TLDR;
export HOME="/home/container"
doesn't work in the install, or in wrappers

[joedwards32]

Got a proposed fix in #191.

Give joedwards32/cs2:4.0.0-pelican a spin.

4.0.0-pelican: digest: sha256:fe7201acccf3bd068f55bcd7dc4c1825f408e9e5b17c27620d099c7ba2d130ab size: 1988

[cowrevenge]

even with wipe and reinstall the error occurs

I found examples of other people having this problem

thijsvanloef/palworld-server-docker#551

ValveSoftware/steam-for-linux#10979

[joedwards32]

What are you using for the Egg configuration?

Pelican doesn't seem to expect the deployment of arbitrary OCI/Docker images not associated with an Egg.

[cowrevenge]

{
"_comment": "DO NOT EDIT: FILE GENERATED AUTOMATICALLY BY PANEL",
"meta": {
"version": "PLCN_v2",
"update_url": null
},
"exported_at": "2025-11-04T21:13:19+00:00",
"name": "Counter-Strike 2 (joedwards32)",
"author": "xxx@xxxxxx.com",
"uuid": "986d81d3-31a5-4124-bd5a-8a49deaa57ef",
"description": "Counter-Strike 2 using ghcr.io/joedwards32/cs2",
"tags": [],
"features": [
"steam_disk_space"
],
"docker_images": {
"joedwards32/cs2:4.0.0-pelican": "joedwards32/cs2:4.0.0-pelican"
},
"file_denylist": [],
"startup": "bash -lc 'cd /home/container/Steam/cs2-dedicated && exec ./game/bin/linuxsteamrt64/cs2 -dedicated -ip 0.0.0.0 -port {{CS2_PORT}} -tv_port {{TV_PORT}} +hostname "{{CS2_SERVERNAME}}" +sv_setsteamaccount {{SRCDS_TOKEN}}'",
"config": {
"files": "{}",
"startup": "{\n "done": "Connection to Steam servers successful"\n}",
"logs": "{}",
"stop": "quit"
},
"scripts": {
"installation": {
"script": "#!/bin/bash\n# Pelican install prep for CS2 under /home/container\n# Enforces uid:gid 999:999 and verifies ownership/writeability.\nset -euo pipefail\numask 002\n\nRUID=999\nRGID=999\n\nexport LANG=C.UTF-8\nexport LC_ALL=C.UTF-8\nexport LANGUAGE=en_US:en\n\nROOT_DIR="/home/container"\nSTEAMAPPDIR="${ROOT_DIR}/Steam"\nINSTALL_DIR="${STEAMAPPDIR}/cs2-dedicated"\n\necho "Using ROOT_DIR=${ROOT_DIR}"\necho "Using STEAMAPPDIR=${STEAMAPPDIR}"\necho "Install dir: ${INSTALL_DIR}"\n\n# Create tree\nmkdir -p \\n "${ROOT_DIR}" \\n "${ROOT_DIR}/"{steamcmd,steamapps,.steam/sdk32,.steam/sdk64} \\n "${STEAMAPPDIR}"/{logs,cs2-dedicated} \\n "${INSTALL_DIR}/game/csgo/cfg"\n\n# Normalize steamapps and compat link\nif [ -d "${STEAMAPPDIR}/steamapps" ] && [ ! -L "${STEAMAPPDIR}/steamapps" ]; then\n rsync -aH --remove-source-files "${STEAMAPPDIR}/steamapps/" "${ROOT_DIR}/steamapps/" || {\n echo "ERROR: migrate Steam/steamapps -> steamapps failed"; exit 1; }\n rmdir "${STEAMAPPDIR}/steamapps" 2>/dev/null || true\nfi\nln -sfn "../steamapps" "${STEAMAPPDIR}/steamapps" || {\n echo "ERROR: symlink Steam/steamapps -> ../steamapps failed"; exit 1; }\n\n# Perms and ownership (MANDATORY 999:999)\nchmod -R u+rwX,g+rwX "${ROOT_DIR}" || { echo "ERROR: chmod ${ROOT_DIR}"; exit 1; }\nchown -R ${RUID}:${RGID} "${ROOT_DIR}" || {\n echo "ERROR: chown to ${RUID}:${RGID} failed; mount may block chown"; exit 1; }\n\n# Verify ownership on critical paths (must be 999:999)\nfor p in "${ROOT_DIR}" "${STEAMAPPDIR}" "${INSTALL_DIR}" "${INSTALL_DIR}/game/csgo/cfg" ; do\n ow="$(stat -c '%u:%g' "$p" 2>/dev/null || echo '?:?')"\n if [ "$ow" != "${RUID}:${RGID}" ]; then\n echo "ERROR: $p ownership is $ow, expected ${RUID}:${RGID}"\n exit 1\n fi\ndone\n\n# atomic permcheck owned by 999:999\ninstall -o ${RUID} -g ${RGID} -m 664 /dev/null "${INSTALL_DIR}/.permcheck"\nprintf 'permcheck %s\n' "$(date -u +%FT%TZ)" >> "${INSTALL_DIR}/.permcheck"\now_chk="$(stat -c '%u:%g' "${INSTALL_DIR}/.permcheck")"\n[ "$ow_chk" = "${RUID}:${RGID}" ] || { echo "ERROR: ${INSTALL_DIR}/.permcheck is $ow_chk, expected ${RUID}:${RGID}"; exit 1; }\n\n# Runtime env\nexport HOME="${ROOT_DIR}"\n\n# Summary\necho "Prep complete."\necho "HOME: ${HOME}"\necho "Ownership enforced: ${RUID}:${RGID}"\necho "Install dir ready: ${INSTALL_DIR}"\necho "CFG dir: ${INSTALL_DIR}/game/csgo/cfg"\necho "Logs dir: ${STEAMAPPDIR}/logs"\necho "Compat link: ${STEAMAPPDIR}/steamapps -> ../steamapps"\n",
"container": "ghcr.io/parkervcp/installers:debian",
"entrypoint": "bash"
}
},
"variables": [
{
"sort": 11,
"name": "Additional Args",
"description": "Extra launch flags",
"env_variable": "CS2_ADDITIONAL_ARGS",
"default_value": "",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 17,
"name": "Bot Difficulty",
"description": "0 easy, 1 normal, 2 hard, 3 expert",
"env_variable": "CS2_BOT_DIFFICULTY",
"default_value": "",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 18,
"name": "Bot Quota",
"description": "Number of bots",
"env_variable": "CS2_BOT_QUOTA",
"default_value": "",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 19,
"name": "Bot Quota Mode",
"description": "fill | competitive",
"env_variable": "CS2_BOT_QUOTA_MODE",
"default_value": "",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 9,
"name": "Cheats",
"description": "0 off, 1 on",
"env_variable": "CS2_CHEATS",
"default_value": "0",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 12,
"name": "Game Alias",
"description": "casual | competitive | deathmatch",
"env_variable": "CS2_GAMEALIAS",
"default_value": "",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 14,
"name": "Game Mode",
"description": "Used if alias empty",
"env_variable": "CS2_GAMEMODE",
"default_value": "1",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 13,
"name": "Game Type",
"description": "Used if alias empty",
"env_variable": "CS2_GAMETYPE",
"default_value": "0",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 4,
"name": "Bind IP",
"description": "Empty = 0.0.0.0",
"env_variable": "CS2_IP",
"default_value": "",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 6,
"name": "LAN Mode",
"description": "0 Internet, 1 LAN",
"env_variable": "CS2_LAN",
"default_value": "0",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 15,
"name": "Map Group",
"description": "e.g., mg_active",
"env_variable": "CS2_MAPGROUP",
"default_value": "mg_active",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 7,
"name": "Max Players",
"description": "Player cap",
"env_variable": "CS2_MAXPLAYERS",
"default_value": "10",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 32,
"name": "CS2 Port",
"description": "",
"env_variable": "CS2_PORT",
"default_value": "SERVER_PORT",
"user_viewable": true,
"user_editable": false,
"rules": []
},
{
"sort": 10,
"name": "Join Password",
"description": "Client join password",
"env_variable": "CS2_PW",
"default_value": "",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 5,
"name": "RCON TCP Port (netconport)",
"description": "Optional TCP net console",
"env_variable": "CS2_RCON_PORT",
"default_value": "",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 2,
"name": "RCON Password",
"description": "Used by +rcon_password",
"env_variable": "CS2_RCONPW",
"default_value": "",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 8,
"name": "Server Hibernate",
"description": "0 off, 1 on",
"env_variable": "CS2_SERVER_HIBERNATE",
"default_value": "0",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 3,
"name": "Server Name",
"description": "Visible server name",
"env_variable": "CS2_SERVERNAME",
"default_value": "Redline CS2",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 16,
"name": "Start Map",
"description": "e.g., de_inferno",
"env_variable": "CS2_STARTMAP",
"default_value": "de_inferno",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 28,
"name": "Debug Level",
"description": "0 none, 1 steamcmd, 2 cs2, 3 all",
"env_variable": "DEBUG",
"default_value": "0",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 29,
"name": "Pelican_fix",
"description": "",
"env_variable": "PELICANFIX",
"default_value": "1",
"user_viewable": true,
"user_editable": false,
"rules": []
},
{
"sort": 30,
"name": "SRCDS_APPID",
"description": "",
"env_variable": "SRCDS_APPID",
"default_value": "730",
"user_viewable": true,
"user_editable": false,
"rules": []
},
{
"sort": 1,
"name": "Steam Gameserver Login Token",
"description": "GSLT for app 730",
"env_variable": "SRCDS_TOKEN",
"default_value": "",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 31,
"name": "STEAMAPPDIR",
"description": "",
"env_variable": "STEAMAPPDIR",
"default_value": "/home/container",
"user_viewable": false,
"user_editable": false,
"rules": []
},
{
"sort": 27,
"name": "Steam Validate",
"description": "0 skip, 1 validate on next start",
"env_variable": "STEAMAPPVALIDATE",
"default_value": "0",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 22,
"name": "CSTV Auto Record",
"description": "0 off, 1 on",
"env_variable": "TV_AUTORECORD",
"default_value": "0",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 26,
"name": "CSTV Delay",
"description": "Seconds",
"env_variable": "TV_DELAY",
"default_value": "0",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 20,
"name": "CSTV Enable",
"description": "0 off, 1 on",
"env_variable": "TV_ENABLE",
"default_value": "0",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 25,
"name": "CSTV Max Rate",
"description": "0 = unlimited",
"env_variable": "TV_MAXRATE",
"default_value": "0",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 21,
"name": "CSTV Port",
"description": "Default 27020",
"env_variable": "TV_PORT",
"default_value": "27020",
"user_viewable": true,
"user_editable": false,
"rules": []
},
{
"sort": 23,
"name": "CSTV Password",
"description": "Viewer password",
"env_variable": "TV_PW",
"default_value": "",
"user_viewable": true,
"user_editable": true,
"rules": []
},
{
"sort": 24,
"name": "CSTV Relay Password",
"description": "Relay password",
"env_variable": "TV_RELAY_PW",
"default_value": "",
"user_viewable": true,
"user_editable": true,
"rules": []
}
]
}

[cowrevenge]

Port Server, and CS2_Port are also conflicting, but that is 100% pelican only, so kind of of a side issue.

[joedwards32]

OK, I can see why Pelican has problems:

        "Config": {
            "User": "999:988",
           ...

            "Mounts": [
                {
                    "Type": "bind",
                    "Source": "/var/lib/pelican/volumes/598f559e-3d33-4002-adac-053a9f2bda2f",
                    "Target": "/home/container"
                },
                {
                    "Type": "bind",
                    "Source": "/etc/pelican/passwd",
                    "Target": "/etc/passwd",
                    "ReadOnly": true
                }
            ],

/etc/pelican/passwd contains:

container:x:999:988::/home/container:/usr/sbin/nologin

Overriding the Dockerfile's USER directive and mapping in a passwd file from the host are both ill advised. It is counter to how user namespace isolation is supposed to work. See:

• https://docs.docker.com/engine/security/userns-remap/
• https://www.docker.com/blog/understanding-the-docker-user-instruction/

In this regard, Pelican's opinionated use of Docker CE isn't OCI compliant and I'm tempted to mark this as wont-fix. Imo, Pelican is simply doing containerization wrong.

That said, it isn't too much work to parameterize the Dockerfile to produce:

• The normal image latest x.x.x
• A special Pelican compatible image latest-pelican x.x.x-pelican

[joedwards32]

I've overwritten joedwards32/cs2:4.0.0-pelican. Make sure you delete your local image and pull a fresh one.

This egg works for me:

{
    "_comment": "DO NOT EDIT: FILE GENERATED AUTOMATICALLY BY PANEL",
    "meta": {
        "version": "PLCN_v3",
        "update_url": null
    },
    "exported_at": "2025-11-05T17:05:41+00:00",
    "name": "cs2",
    "author": "joedwards32@gmail.com",
    "uuid": "9c2f53e7-51bf-433c-bf84-e853a7c42ab1",
    "description": null,
    "tags": [],
    "features": [],
    "docker_images": {
        "joedwards32/cs2:4.0.0-pelican": "joedwards32/cs2:4.0.0-pelican"
    },
    "file_denylist": [],
    "startup_commands": {
        "entrypoint": "/home/steam/entry.sh"
    },
    "config": {
        "files": "{}",
        "startup": "{}",
        "logs": "{}",
        "stop": "^C"
    },
    "scripts": {
        "installation": {
            "script": null,
            "container": "ghcr.io/pelican-eggs/installers:debian",
            "entrypoint": "bash"
        }
    },
    "variables": [
        {
            "name": "SRCDS_TOKEN",
            "description": "Game Server Token from https://steamcommunity.com/dev/managegameservers",
            "env_variable": "SRCDS_TOKEN",
            "default_value": "",
            "user_viewable": true,
            "user_editable": false,
            "rules": [],
            "sort": 2
        },
        {
            "name": "STEAMAPPDIR",
            "description": "",
            "env_variable": "STEAMAPPDIR",
            "default_value": "/home/container",
            "user_viewable": false,
            "user_editable": false,
            "rules": [],
            "sort": 1
        }
    ]
}