[AUTOPAUSE] Why can't wake up with knock localhost 25575 in pause?

[MusclePr]

I have a question about technical interest.

Why can't wake up with knock localhost 25575 in pause?

log: (paused)

sandbox  | [2025-01-27T17:38:11+09:00] [Autopause] Pausing Java process

Send knock commands...

$ docker exec -it sandbox knock localhost 25575
$ docker exec -it sandbox knock localhost 25575
$ docker exec -it sandbox knock localhost 25575
$ docker exec -it sandbox knock localhost 25575
$ docker exec -it sandbox knock localhost 25575

But, no response in log.

sandbox  | [2025-01-27T17:38:11+09:00] [Autopause] Pausing Java process

Why can wake up by rcon in pause?

I send any command by rcon to wake up.

$ docker exec -it sandbox rcon-cli list
There are 0 of a max of 20 players online: 

log: (wake up)

sandbox  | [17:45:16 WARN]: Can't keep up! Is the server overloaded? Running 425559ms or 8511 ticks behind
sandbox  | [17:45:16 INFO]: Thread RCON Client /0:0:0:0:0:0:0:1 started
sandbox  | [17:45:16 INFO]: Thread RCON Client /0:0:0:0:0:0:0:1 shutting down
sandbox  | [Autopause loop] Server was knocked - waiting for clients or timeout

The Knock command responded while running.

$ docker exec -it sandbox knock localhost 25575

log: (running)

sandbox  | [17:47:03 INFO]: Thread RCON Client /0:0:0:0:0:0:0:1 started
sandbox  | [17:47:03 INFO]: Thread RCON Client /0:0:0:0:0:0:0:1 shutting down

Environment

compose.yml

services:
  mc:
    image: "itzg/minecraft-server:latest"
    container_name: "sandbox"
    environment:
      TZ: "Asia/Tokyo"
      EULA: "true"
      SERVER_NAME: "Sandbox"
      TYPE: "paper"
      ENABLE_AUTOPAUSE: "true"
      JVM_DD_OPTS: "disable.watchdog:true"
      AUTOPAUSE_TIMEOUT_EST: 10
      AUTOPAUSE_TIMEOUT_INIT: 30
    ports:
      - "25565:25565"
    volumes:
      - "./data:/data"

[itzg]

I didn't even know knock was a command included in the image. The auto pause uses knockd (with a "d") to run the daemon process.

[MusclePr]

Thank you for your reply.
Yes, I know 'knockd'.
There are cases where knockd cannot detect a port knock from inside a container.

• Host IP: 172.21.188.114 172.19.0.1
• Container IP: 172.19.0.2
• Container's Gateway IP: 172.19.0.1
• Host's tcp 25575 port is no expose

Host	Container	Paused	Unpaused
nc localhost 25575
	nc localhost 25575	(Why?)	Thread RCON Client /0:0:0:0:0:0:0:1 started
nc 172.19.0.2 25575		Thread RCON Client /172.19.0.1 started	Thread RCON Client /172.19.0.1 started
	nc 172.19.0.2 25575	(Why?)	Thread RCON Client /172.19.0.2 started
rcon-cli --host localhost
	rcon-cli --host localhost	Thread RCON Client /0:0:0:0:0:0:0:1 started	Thread RCON Client /0:0:0:0:0:0:0:1 started
rcon-cli --host 172.19.0.2		Thread RCON Client /172.19.0.1 started	Thread RCON Client /172.19.0.1 started
	rcon-cli --host 172.19.0.2	Thread RCON Client /172.19.0.2 started	Thread RCON Client /172.19.0.2 started

I am using the nc command installed by apt install netcat-openbsd.

---

docker inspect sandbox | jq '.[].NetworkSettings'

{
  "Bridge": "",
  "SandboxID": "6c45af3a584cd33d92201e5ad8e980479020329e3e7b7ed2ffd30543389552b6",
  "SandboxKey": "/var/run/docker/netns/6c45af3a584c",
  "Ports": {
    "25565/tcp": [
      {
        "HostIp": "0.0.0.0",
        "HostPort": "25565"
      },
      {
        "HostIp": "::",
        "HostPort": "25565"
      }
    ]
  },
  "HairpinMode": false,
  "LinkLocalIPv6Address": "",
  "LinkLocalIPv6PrefixLen": 0,
  "SecondaryIPAddresses": null,
  "SecondaryIPv6Addresses": null,
  "EndpointID": "",
  "Gateway": "",
  "GlobalIPv6Address": "",
  "GlobalIPv6PrefixLen": 0,
  "IPAddress": "",
  "IPPrefixLen": 0,
  "IPv6Gateway": "",
  "MacAddress": "",
  "Networks": {
    "sandbox_default": {
      "IPAMConfig": null,
      "Links": null,
      "Aliases": [
        "sandbox",
        "mc"
      ],
      "MacAddress": "02:42:ac:13:00:02",
      "DriverOpts": null,
      "NetworkID": "f9a196916c9746d5b438fa236a7faf150c047a845f3a4c17e4273666272379a9",
      "EndpointID": "f1ff9536cad718b27f90ca252e1b8bff0be7b0f10041aedeedecc8cb3e89efc4",
      "Gateway": "172.19.0.1",
      "IPAddress": "172.19.0.2",
      "IPPrefixLen": 16,
      "IPv6Gateway": "",
      "GlobalIPv6Address": "",
      "GlobalIPv6PrefixLen": 0,
      "DNSNames": [
        "sandbox",
        "mc",
        "c60edbc11d11"
      ]
    }
  }
}

[itzg]

If it helps, the config file used is

https://github.com/itzg/docker-minecraft-server/blob/master/files/auto/knockd-config.cfg

and knockd is started here

docker-minecraft-server/files/auto/autopause-daemon.sh

Line 51 in dff4673

sudo /usr/local/sbin/knockd "${knockdArgs[@]}"

[MusclePr]

Thank you for your reply.
I thought that if one SYN came within 1 second, a knock would be established, but maybe that's not the case?
I'll check the documentation.