Get started
How-to guides
Reference
Concepts
Self-host gallery
Appendixitzg/minecraft-server image. Its own documentation covers every server setting: docker-minecraft-server. See the generated Minecraft Server template page for the template’s current ports, volumes and variables.
The template pins the image tag 2026.10.1 and offers two Java runtimes in the Java runtime field: java21 (the default) and java25. You must enter TRUE for the EULA yourself, it is never accepted for you and the deploy form refuses an empty value. The server type is one of VANILLA, PAPER, FABRIC or FORGE.
The Minecraft version defaults to 1.21.11, which boots on the Java 21 image (tested). LATEST stays selectable, but it can resolve to a release that needs a newer Java: the 26.x releases need Java 25, so on the Java 21 image the server exits with UnsupportedClassVersionError. Set the Java runtime to java25 when you pick LATEST or a 26.x version. Both tags publish amd64 and arm64.
RCON is on with a generated password (kept as a secret) and its port is not published, so run levelrail-cli apps console <app> for an interactive RCON prompt, or levelrail-cli apps console <app> -- list for one command. The password stays in the container’s environment and is never printed or put on a command line. Other game templates declare no console yet, use apps exec for them.
Sizing
The numbers below are rough guidance from how Java servers behave in general. They are not benchmarks, and Levelrail has not measured them. Memory use grows with players, view distance, loaded chunks and mods or plugins.
The template’s JVM heap defaults to 2G and the container memory limit to 2560M, which is 25 percent above the heap. If you raise the heap, raise the container limit field with it to keep that headroom; a limit left at the template default is not scaled for you. The template also sets a recommended memory figure. The Java heap is only part of the process: leave room for the JVM itself, the operating system and the Levelrail control plane. Lowering the view distance and simulation distance in the server settings reduces both memory and CPU. Raise the heap only if you see out-of-memory errors or long pauses.
Ports
A Minecraft Java server listens on TCP 25565. Some other games use UDP. Check the game’s documentation, then publish the right protocol for the game. A UDP service is published asHOST:CONTAINER/udp, see UDP published ports.
Direct game ports do not go through the HTTP reverse proxy, and the Minecraft and Terraria templates declare their TCP port as a published port, so no web address is generated for them. A published port follows the exposure rules in App ports and exposure: it is bound privately (127.0.0.1) by default, and you choose to make it public. The templates do not make a game port public for you, because a template cannot declare a public bind and private by default is the platform’s stance.
To make a TCP game port such as Minecraft’s 25565 public, use a stream: levelrail-cli apps streams create <app> --host-port 25565 --container-port 25565, then levelrail-cli apps restart <app> --wait. The template’s private bind then moves to a random loopback port so the stream can listen on 25565 itself. apps exposure <app> --mode direct --host-port 25565 --port 25565 also works, and the template’s private bind is dropped in favour of it. Both are covered by reconciler tests only; they have not yet been proven from the internet on a real host. UDP games publish as /udp and are not affected by this; UDP exposure is also not host-proven. After making a port public, open it in both firewall layers below.
Status and join address
levelrail-cli apps game-status <app> (and the status card on the app page in the dashboard) shows whether the server answers, its version, players online and the round-trip time, plus the address your players type in. For Minecraft Java it speaks the server list ping; for any other TCP game port it only checks that a connection opens, so it reports online without players or version. UDP games (Bedrock, Palworld) are not probed.
The join address is your server’s public host and the public port, from a stream, a public published port or a direct exposure. It needs APP_PUBLIC_HOST (or the detected public IP) to be known; with a private port it says so instead of showing an address. The API is GET /api/v1/apps/{name}/game-status.
The ping only ever connects to the app’s own port on the same host (loopback), never to an address you supply, so it cannot be pointed at other machines. It proves the game answers on this host, not that the internet can reach it: still test a join from another network. Answers are reused for a few seconds so several viewers do not ping the server each time. Two runtime settings tune it: games.status_timeout (default 3s, seeded by APP_GAME_STATUS_TIMEOUT) and games.status_cache (default 5s, seeded by APP_GAME_STATUS_CACHE). This has not yet been checked against a real Minecraft client on a real host.
Two firewall layers
Players can connect only if both layers allow the port:- The cloud firewall: security group, VCN security list or network security group at your provider. Levelrail cannot change this one.
- The host firewall on the VM: ufw, firewalld, nftables or iptables. See Host firewall.
INPUT chain, so the host layer may not block them, but do not assume. Test from a different network. For Oracle specifics see Install on Oracle Cloud.
Backups
A world is a set of files that change while the server runs. Copying them mid-write can give a corrupted backup. The usual approach is to pause world saving, flush to disk, take the backup, then resume saving. Check the upstream docs above for how to run server console commands in that image. Levelrail can back up an app volume to an S3-compatible target on a schedule, see Backup targets and volume backups. Each volume can have a pre-backup and a post-backup command, set withlevelrail-cli backups volumes policy set <app> <volume> --pre-hook '...' --post-hook '...'. The post command always runs, even when the pre command fails or times out. A failed or timed-out pre command still produces a backup, recorded with an inconsistent: warning, so check that warning before you rely on the copy. Hooks are capped by APP_BACKUP_HOOK_TIMEOUT_SECONDS and APP_BACKUP_HOOK_MAX_SECONDS, and their output by APP_BACKUP_HOOK_MAX_OUTPUT_BYTES. The --pause option freezes the container while the archive streams instead.
For a Minecraft preset that runs rcon-cli (save-off, save-all flush, save-on), see the Minecraft example in Prove your backups work. Without hooks, stop the server before the backup runs or take the backup when nobody is online. To take one by hand, run levelrail-cli app-volume-backups trigger <app> <volume> --target ID. Rehearse a restore before you rely on it: see Prove your backups work.
Other game templates
Levelrail also ships templates for Minecraft Bedrock, Palworld, Terraria and Factorio, listed in the Template catalog. Bedrock listens on UDP 19132. Bedrock and Palworld are x86 game software, so on an arm64 host they run under emulation and need more CPU. Palworld needs about 16 GB of RAM for a few players, which does not fit a 12 GB host shared with other apps.Arm VMs
On an Arm VM, check that the image tag you use has alinux/arm64 build (for example with docker buildx imagetools inspect <image:tag>). Levelrail has not verified this for every game image, so check each one before installing. See Template catalog.