Manage Minecraft in Docker with RCON and the console

Run server commands

For one-shot commands, use:

docker exec mc rcon-cli stop
docker exec mc rcon-cli op YourPlayerName
docker exec mc rcon-cli whitelist add YourPlayerName

For interactive RCON:

docker exec -i mc rcon-cli

The -i flag matters for interactive use.

Why RCON is the default path

The image enables RCON by default and uses it for safe server control. That matters for two reasons:

• clean shutdowns use the same admin path
• backup tooling can coordinate save state over RCON

Step 1: Set an RCON password

If you have never set one, do it now. Use RCON_PASSWORD_FILE to read the password from a file.

services:
  mc:
    image: itzg/minecraft-server:latest
    tty: true
    stdin_open: true
    environment:
      EULA: "TRUE"
      RCON_PASSWORD_FILE: /run/secrets/rcon_pass
    secrets:
      - rcon_pass

secrets:
  rcon_pass:
    file: ./rcon_password

This keeps the secret out of the Compose file itself.

Step 2: Use rcon-cli for normal admin tasks

Common commands:

docker exec mc rcon-cli list
docker exec mc rcon-cli save-all
docker exec mc rcon-cli op YourPlayerName
docker exec mc rcon-cli whitelist on
docker exec mc rcon-cli whitelist add YourPlayerName

For ongoing administration, an interactive shell is more comfortable:

docker exec -i mc rcon-cli

Then type normal Minecraft console commands one by one.

Step 3: Enable interactive console only if you actually need it

Some admins want the full console for log reading and tab-completion. For that, keep stdin_open and tty enabled:

services:
  mc:
    tty: true
    stdin_open: true

Then attach:

docker compose attach mc

Or, if you run plain Docker:

docker attach mc

To detach without stopping the container, use:

Ctrl-P Ctrl-Q

Step 4: Keep RCON off the public internet

In most setups you should not publish the RCON port externally at all.

Avoid this unless you have a very specific reason:

ports:
  - "25575:25575"

The normal player-facing port is the game port. RCON is an admin interface and should stay private.

Step 5: Validate your setup

Run a safe command:

docker exec mc rcon-cli list

If you get a normal response from the server, your admin path works. If not, check:

• whether the container is healthy
• whether the password is set correctly
• whether you accidentally disabled RCON

Common mistakes