Bedrock Dedicated Server (BDS) version 1.26.50 and later uses the newer NetherNet transport by default. Clients connect to TCP port 19132 first. Then each client uses a UDP port for gameplay.
The following starts a server on a LAN. Replace 192.168.1.10 with the IP address of the Docker host.
Alternatively, you can use <public_ip> in place of an ip address to resolve to your public ip at startup.
docker run -d -it -e EULA=TRUE \
-e SERVER_UDP_PORTS="192.168.1.10:19140-19155:19140-19155" \
-p 19132:19132/tcp -p 19140-19155:19140-19155/udp \
-v mc-bedrock-data:/data itzg/minecraft-bedrock-serverFor more information, see NetherNet.
NOTE: if you plan on running a server for a longer amount of time it is highly recommended using a management layer such as Docker Compose or Kubernetes to allow for incremental reconfiguration and image upgrades.
With the VERSION variable set to "LATEST", which is the default, then the Bedrock server can be upgraded by restarting the container. At every startup, the container checks for the latest version and upgrades, if needed.
The latest preview version can be requested by setting VERSION to "PREVIEW".
NOTE the Bedrock server software is not bundled into this image. Instead, it is downloaded/upgraded from Mojang only during container startup. As such, releases of this image are independent of releases of Mojang's software.
All image tags can be located in Docker Hub or GitHub Container Registry.
| Tag | |
|---|---|
latest |
includes the latest features merged to primary branch |
#.#.# |
a specific release of the image |
stable |
points to the newest image release |
Note
For example:
itzg/minecraft-bedrock-server:latestitzg/minecraft-bedrock-serveritzg/minecraft-bedrock-server:2026.4.1itzg/minecraft-bedrock-server:stable
For Minecraft Java Edition you'll need to use this image instead:
EULA(no default) : must be set toTRUEto accept the Minecraft End User License AgreementVERSION(default isLATEST) : can be set to a specific server version or the following special values can be used:LATEST: determines the latest (non-preview) version and can be used to auto-upgrade on container startPREVIEW: determines the latest preview version and will auto-upgradeEXISTING: use existing bedrock server executable in/data. Must be named eitherbedrock_server-{version}or justbedrock_server- otherwise any specific server version can be provided. If it is a preview version, also set
PREVIEWto "true"
UID(default derived from/dataowner) : can be set to a specific user ID to run the bedrock server processGID(default derived from/dataowner) : can be set to a specific group ID to run the bedrock server processTZ(no default): can be set to a specific timezone likeAmerica/New_York. This will set the timezone for the Docker container and therefore their logs. Addtionally, if you want to sync the time with the host, you can mount the/etc/localtimefile from the host to the container like/etc/localtime:/etc/localtime:ro.PACKAGE_BACKUP_KEEP(2) : how many package backups to keepDIRECT_DOWNLOAD_URL(no default): This environment variable can be used to provide a direct download URL for the Minecraft Bedrock server.zipfile. When set, this URL will be used instead of attempting to automatically look up the download link fromminecraft.net. This is particularly useful for CI/CD environments or when the automatic version lookup is temporarily broken due to website changes. Ensure the URL points directly to thebedrock-server-VERSION.zipfile.DOWNLOAD_PROGRESS(default isfalse) : When set totrue, displays a progress bar during the Bedrock server download instead of running silently.ENABLE_SSH(default isfalse) : Enable remote console over SSH on 2222 (orREMOTE_CONSOLE_BIND_ADDRESSif provided) if this environment variable is set totrue.REMOTE_CONSOLE_BIND_ADDRESS(default is :2222) : Set the address to bind to for SSH remote console.ENABLE_BDS_V6BIND_FIX(default isfalse) : allowsSERVER_PORTandSERVER_PORT_V6to be set to the same port when using the older RakNet protocol. See IPv6 same-port fix. Enabling it should mitigate connectivity issues in dual-stack setups using RakNet.MC_PACK(no default): Path inside the container to a single archive file (e.g..mcpack,.mcworld,.mctemplate,.mcaddon, or any zip) or to a directory with the same layout. At startup the archive is unpacked (or the directory is read): top-levelbehavior_packs/is merged intobehavior_packs/, top-levelresource_packs/intoresource_packs/, and all other content (whenlevel.datis present) intoworlds/{LEVEL_NAME}. For.mcaddonarchives, which use root-leveldata/(behavior) andresources/(resource) folders instead ofbehavior_packs/andresource_packs/, these are detected and installed automatically using the pack UUID from each manifest as the folder name.FORCE_WORLD_COPY(defaultfalse): WhenMC_PACKcontains a world (level.dat), set totrueto remove and replace the existingworlds/{LEVEL_NAME}on every startup; otherwise the world is copied only when it does not exist.FORCE_PACK_COPY(defaultfalse): WhenMC_PACKcontainsbehavior_packs/orresource_packs/, set totrueto remove and replace existing pack folders with the same name on every startup; otherwise each pack is copied only when it does not already exist.STOP_SERVER_ANNOUNCE_DELAY(no default — disabled): opt into a graceful shutdown announcement. When set to a positive whole number of seconds, a heads-up line is written to the server console on container stop (SIGTERM); after that many seconds the server is sentstop(the usual clean-save shutdown). Unset or0keeps the previous behavior of stopping immediately. A secondSIGTERMskips the remaining wait. Keep the value shorter than the container's stop grace period (e.g.docker stop -t, ECSstopTimeout, or an EC2 Spot interruption's ~2‑minute window) so the world save isn't cut short bySIGKILL.STOP_SERVER_ANNOUNCE(defaultsay Server shutting down in %delay% seconds): the console line written as the announcement whenSTOP_SERVER_ANNOUNCE_DELAYis active. The%delay%token is replaced with the delay's whole-second value. Any server command works (e.g. asayortellraw).
The following environment variables will set the equivalent property in server.properties, where each is described here.
Typically, each property is configured instead by the UPPER_SNAKE_CASE equivalent.
SERVER_NAMEGAMEMODEFORCE_GAMEMODEDIFFICULTYALLOW_CHEATSMAX_PLAYERSONLINE_MODEWHITE_LISTALLOW_LISTSERVER_PORTSERVER_PORT_V6SERVER_IPSERVER_UDP_PORTSTRANSPORTENABLE_LAN_VISIBILITYVIEW_DISTANCETICK_DISTANCEPLAYER_IDLE_TIMEOUTMAX_THREADSLEVEL_NAMELEVEL_SEEDLEVEL_TYPEDEFAULT_PLAYER_PERMISSION_LEVELTEXTUREPACK_REQUIREDCONTENT_LOG_FILE_ENABLEDCONTENT_LOG_LEVELCONTENT_LOG_CONSOLE_OUTPUT_ENABLEDCOMPRESSION_THRESHOLDCOMPRESSION_ALGORITHMSERVER_AUTHORITATIVE_MOVEMENTPLAYER_POSITION_ACCEPTANCE_THRESHOLDPLAYER_MOVEMENT_SCORE_THRESHOLDPLAYER_MOVEMENT_ACTION_DIRECTION_THRESHOLDPLAYER_MOVEMENT_DISTANCE_THRESHOLDPLAYER_MOVEMENT_DURATION_THRESHOLD_IN_MSCORRECT_PLAYER_MOVEMENTSERVER_AUTHORITATIVE_BLOCK_BREAKINGSERVER_AUTHORITATIVE_BLOCK_BREAKING_PICK_RANGE_SCALARCHAT_RESTRICTIONDISABLE_PLAYER_INTERACTIONCLIENT_SIDE_CHUNK_GENERATION_ENABLEDBLOCK_NETWORK_IDS_ARE_HASHESDISABLE_PERSONADISABLE_CUSTOM_SKINSSERVER_BUILD_RADIUS_RATIOALLOW_OUTBOUND_SCRIPT_DEBUGGINGALLOW_INBOUND_SCRIPT_DEBUGGINGFORCE_INBOUND_DEBUG_PORTSCRIPT_DEBUGGER_AUTO_ATTACHSCRIPT_DEBUGGER_AUTO_ATTACH_CONNECT_ADDRESSSCRIPT_WATCHDOG_ENABLESCRIPT_WATCHDOG_ENABLE_EXCEPTION_HANDLINGSCRIPT_WATCHDOG_ENABLE_SHUTDOWNSCRIPT_WATCHDOG_HANG_EXCEPTIONSCRIPT_WATCHDOG_HANG_THRESHOLDSCRIPT_WATCHDOG_SPIKE_THRESHOLDSCRIPT_WATCHDOG_SLOW_THRESHOLDSCRIPT_WATCHDOG_MEMORY_WARNINGSCRIPT_WATCHDOG_MEMORY_LIMITOP_PERMISSION_LEVELEMIT_SERVER_TELEMETRYMSA_GAMERTAGS_ONLYITEM_TRANSACTION_LOGGING_ENABLEDVARIABLES
For example, to configure a flat, creative server instead of the default use:
docker run -d -it --name bds-flat-creative \
-e EULA=TRUE -e LEVEL_TYPE=flat -e GAMEMODE=creative \
-e SERVER_UDP_PORTS="192.168.1.10:19140-19155:19140-19155" \
-p 19132:19132/tcp -p 19140-19155:19140-19155/udp itzg/minecraft-bedrock-server- TCP 19132 : NetherNet signaling for IPv4 and IPv6 clients, set by
SERVER_PORT - UDP range : NetherNet gameplay, set by
SERVER_UDP_PORTS. The image does not set a default range. Publish the range that you set. - UDP 19132 and 19133 : only for
TRANSPORT=raknet, set bySERVER_PORT(IPv4) andSERVER_PORT_V6(IPv6)
BDS 1.26.50 and later sets transport=nethernet in server.properties by default.
NetherNet is a WebRTC-based transport.
For the BDS documentation, see the "Transport" section of bedrock_server_how_to.html in the /data volume.
For the signaling protocol, see the Mojang NetherNet onboarding guide.
With NetherNet, BDS uses these ports:
- TCP
SERVER_PORT(default 19132): an HTTP signaling handshake. BDS uses one dual-stack socket for IPv4 and IPv6.SERVER_PORT_V6has no effect. - UDP gameplay ports: BDS uses one UDP port for each client connection. By default, BDS uses a port from the ephemeral range of the operating system. Set
SERVER_UDP_PORTSto use a fixed range. - UDP 7551: LAN discovery. Discovery uses broadcast packets, thus it works only on the same subnet.
BDS does not listen on UDP port 19132. If a client sends UDP packets to port 19132, the server does not reply.
TRANSPORT, SERVER_UDP_PORTS, and SERVER_IP are mapped into server.properties the same way as the other keys on this list.
During the handshake, BDS sends the client a list of addresses and UDP ports. The client must be able to reach one of these addresses.
- With
network_mode: host, BDS sends the addresses of the host. Set only the port range, for exampleSERVER_UDP_PORTS: "19140-19155". - With a Docker bridge network, rootless networking or NAT, BDS can send addresses that the client cannot reach. Set the address that clients use, for example
SERVER_UDP_PORTS: "192.168.1.10:19140-19155:19140-19155". - IMPORTANT: to access over the internet you need to use the public ip in the
SERVER_UDP_PORTS, and forward all the ports.
Use an IPv4 or IPv6 literal, not a hostname.
To use the public IP address of the host, use the literal string <public_ip>. At startup, the image replaces it with the result of curl ifconfig.me.
Use a range with at least one port for each player (max-players, default 10).
Publish the TCP port and the full UDP range.
For an example, see examples/nethernet/compose.yml.
On the host firewall and on all network firewalls between the clients and the server, allow these inbound connections:
- TCP
SERVER_PORT(default 19132) - The UDP range in
SERVER_UDP_PORTS - UDP 7551, only if you use LAN discovery on the same subnet
The container health check connects to the server through the loopback interface. Thus a "healthy" status does not show that clients can connect through the firewall. To do a test, run this command on a different computer:
curl http://<server-ip>:19132/v1/joinThe server sends its name, version and number of players as JSON.
Recent BDS versions set allow-list=true by default.
If the list is empty, the server refuses all players with the message "You're not invited to play on this server".
Add players with ALLOW_LIST_USERS (see Allowlist), or set ALLOW_LIST=false.
To use the earlier UDP transport, set TRANSPORT=raknet.
BDS then listens on UDP SERVER_PORT (IPv4, default 19132) and UDP SERVER_PORT_V6 (IPv6, default 19133).
Publish both ports, for example -p 19132:19132/udp -p 19133:19133/udp.
BDS 1.26.51 logs an error that NetherNet is the only supported transport.
NOTE: Aternos reports that Minecraft 26.60 removes RakNet. Refer to NetherNet protocol (Minecraft: Bedrock Edition).
NOTE: This fix applies only to
TRANSPORT=raknet. Do not use it with NetherNet. The shim changes each IPv6 socket that binds toSERVER_PORT_V6, which includes the NetherNet TCP socket. IfSERVER_PORT_V6is equal toSERVER_PORT, the TCP socket becomes IPv6-only, and IPv4 clients cannot connect.
BDS binds IPv4 and IPv6 on separate ports by default (19132 and 19133).
Bedrock clients do not implement Happy Eyeballs, so a player whose device
resolves the hostname to IPv6 connects to port 19132 over IPv6 and times out
-- the server only accepts IPv6 on 19133. Set ENABLE_BDS_V6BIND_FIX=true
to enable a runtime shim (bds-ipv6fix)
that patches BDS to allow both address families on the same port number, then
set both properties to the same value:
environment:
EULA: "TRUE"
ENABLE_BDS_V6BIND_FIX: "true"
SERVER_PORT: 19132
SERVER_PORT_V6: 19132
ports:
- "19132:19132/udp"NOTE:
SERVER_PORT_V6equal toSERVER_PORTrequiresENABLE_BDS_V6BIND_FIX=true; without it BDS will crash. Always set the IPv6 port viaSERVER_PORT_V6, do not set ports viaserver.properties.
/data: the location where the downloaded server is expanded and ran. Also contains the configuration properties fileserver.properties
NOTE: On hosts with SELinux enabled (for example Fedora or RHEL), add a label option to bind mounts, for example
-v ./data:/data:z. Without the option, SELinux can prevent the container from reading or writing the folder. Use:z(lower case) if more than one container uses the same folder.:Z(upper case) gives the folder a private label for one container only. Named volumes do not need the option.
You can create a named volume and use it as:
docker volume create mc-volume
docker run -d -it --name mc-server -e EULA=TRUE \
-e SERVER_UDP_PORTS="192.168.1.10:19140-19155:19140-19155" \
-p 19132:19132/tcp -p 19140-19155:19140-19155/udp \
-v mc-volume:/data itzg/minecraft-bedrock-serverIf you're using a named volume and want the bedrock process to run as a non-root user then you will need to pre-create the volume and chown it to the desired user.
For example, if you want the bedrock server to run with user ID 1000 and group ID 1000, then create and chown the volume named "bedrock" using:
docker run --rm -v bedrock:/data alpine chown 1000:1000 /dataIf using docker run then simply reference that volume "bedrock" in the -v argument. If using a compose file, declare the volume as an external using this type of declaration:
volumes:
bedrock:
external:
name: bedrockWhen running the container on your LAN, you can find and connect to the dedicated server in the "LAN Games" part of the "Friends" tab, such as:
With NetherNet, LAN discovery uses UDP port 7551 broadcasts. If the server does not show in "LAN Games", add it in the "Servers" tab. Use the IP address of the host and the TCP port (default 19132).
The Bedrock Dedicated Server requires permissions be defined with XUIDs or Xbox GamerTag. Each of OPS, MEMBERS, and VISITORS accepts a comma-separated or newline-separated list of identifiers. For each entry you can use:
- XUID — a 16+ digit number (e.g.
2535453759792258). You can look these up with tools like MCProfile; the XUID is also printed in the server log when a player joins. - Xbox gamertag — if the value is not a long numeric XUID, it is treated as a gamertag and resolved to an XUID at startup via the MCProfile API. This allows using names instead of numbers.
There are 3 levels of permissions and 3 options to configure each group:
You can mix XUIDs and gamertags in the same list. The API base URL used for resolving gamertags can be overridden with RESOLVE_XUID_API_URL (default: https://mcprofile.io/api/v1/bedrock/gamertag).
OPSis used to define operators on the server.
-e OPS="1234567890,0987654321,player1"MEMBERSis used to define the members on the server.
-e MEMBERS="1234567890,player2"VISITORSis used to define visitors on the server.
-e VISITORS="player3,player4"docker-compose.yml example:
environment:
OPS: |
1234567890
player1
MEMBERS: |
player2
VISITORS: |
player3
player4There are two ways to handle a whitelist:
The first is to set the ALLOW_LIST environment variable to true and map in an allowlist.json file (previously known as "whitelist.json") that is custom-crafted to the container.
The other is to set the ALLOW_LIST_USERS environment variable to a comma-separated or newline-separated of gamer tag usernames and their corresponding XUIDs. Each username should be followed by its XUID, separated by a colon. The server will use these details to match the player.
There are various tools to look XUIDs up online and they are also printed to the log when a player joins the server.
-e ALLOW_LIST_USERS="player1:1234567890,player2:0987654321"docker-compose.yml example:
environment:
ALLOW_LIST_USERS: |
player1:1234567890
player2:0987654321Custom server variables are supported by Bedrock. Details and usage instructions can be found on the official bedrock documentation, located here:
Custom server variables are passed in as comma-separated or newline-separated simple key-value pairs or as a full JSON string.
Server variables are parsed into their most likely type (number-like turn into numbers, all other inputs are treated as string) using jq's fromjson command. In the example below, var1 is a string, var2 is a number, and var3 is a string.
For greater control on types, users can provide a full string JSON representation that is used as-is.
All variables are written to the variables file located at config/default/variables.json. There is no support for Module-specific variable handling at this time.
# passing in simple expressions
-e VARIABLES="var1=customStringValue,var2=1234,var3=true"
# pass in a full json object:
-e VARIABLES='{"mobSpawnRate":22,"enableCheats":true,"worldArray":["My World", "Abc", 123]}'docker-compose.yml example:
environment:
VARIABLES: |
var1=customStringValue
var2=1234
var3=trueAlso known as behavior or resource packs, in order to add mods into your server you can follow these steps, tested with OPS (One Player Sleep) and bedrocktweaks
Tip: You can import an archive at startup by setting
MC_PACKto the in-container path (see Environment Variables). The archive is unpacked:behavior_packs/andresource_packs/go to the server's pack folders; if the archive contains a world (level.dat), the rest goes toworlds/{LEVEL_NAME}.
- Install the mcpack or mcaddon on the client side first, just to make it easier to copy the files to the server, for Windows 10 files should be located on
C:\Users\USER\AppData\Local\Packages\Microsoft.MinecraftUWP_*\LocalState\games\com.mojang. - Copy over the folders of the mods from either behavior_packs or resource_packs into the server's volume.
If you want to install them without using a client you should be able to unzip the mods directly into the server's volume, .mcaddon should go into behavior_packs and .mcpack into resource_packs. Both .mcaddon and .mcpack are actually renamed .zip files.
- Lastly create on the server's volume
worlds/$level-name/world_behavior_packs.json, you'll need to add an entry for each mod like on the previous manifest.json, we only need the uuid now called pack_id and the version replacing dots with commas and double quotes with [ ].
You can also create a
worlds/$level-name/world_resource_packs.jsonbut I have seen that putting both resource and behavior packs inside the same json works just fine
[
{
"pack_id" : "5f51f7b7-85dc-44da-a3ef-a48d8414e4d5",
"version" : [ 3, 0, 0 ]
}
]
- Restart the server and the mods should be enabled now! when connecting you will get a prompt asking if you want to "Download & Join" or just "Join", You need to Download & Join if you want to actually see the new resource pack added to the server. This prompt is exclusive to resource packs as these alter how minecraft looks while behavior packs alter how minecraft functions and don't need to be downloaded or installed on the client side.
If you want to force the resource pack on all clients, there's an option
texturepack-required=falseinserver.propertiesthat should be changed totrue. Resource packs can be deleted by going into Settings > Storage > Cached Data, then selecting the pack and clicking on the trash can.
For more information FoxyNoTail did a video explaining the same on a server running on Windows.
For more information about managing Bedrock Dedicated Servers in general, check out this Reddit post.
This image comes bundled with a script called send-command that will send a Bedrock command and argument to the Bedrock server console. The output of the command only be visible in the container logs.
For example:
docker exec CONTAINER_NAME_OR_ID send-command gamerule dofiretick false
Alternatively, with stdin and tty enabled (such as using -it), attach to the container's console by its name or ID using:
docker attach CONTAINER_NAME_OR_IDWhile attached, you can execute any server-side commands, such as op'ing your player to be admin:
gamerule dofiretick false
When finished, detach from the server console using Ctrl-p, Ctrl-q
The examples directory contains an example Docker compose file that declares:
- A service running the bedrock server container. In the example is named "bds", short for "Bedrock Dedicated Server", but you can name the service whatever you want.
- The service exposes TCP port 19132 and UDP ports 19140-19155 for NetherNet. For more information, see NetherNet.
- For LAN only: Replace
192.168.1.10with the IP address of the Docker host. - For Internet: Replace
192.168.1.10with a static public IP address, or<public_ip>to look up your current IP at startup.
- For LAN only: Replace
- EULA must be true, other env variables can be defined to configure the server here as well.
- A volume attached to the service at the container path
/data
services:
bds:
image: itzg/minecraft-bedrock-server
environment:
EULA: "TRUE"
# NetherNet: replace 192.168.1.10 with the IP address of the Docker host
# If this server is meant to be accessible over the internet, and has a dynamic you
# can use "<public_ip>" in place of an ip address to resolve your public ip on startup
SERVER_UDP_PORTS: "192.168.1.10:19140-19155:19140-19155"
ports:
# Note the newer NetherNet protocol uses different ports to RakNet
- "19132:19132/tcp"
- "19140-19155:19140-19155/udp"
volumes:
- ./data:/data
stdin_open: true
tty: trueStart the server and run in the background using:
docker compose up -dYou can follow the logs at any time using:
docker compose logs -fThe examples directory contains an example Kubernetes manifest file that declares:
- a peristent volume claim (using default storage class)
- a pod deployment that uses the declared PVC
- a service of type LoadBalancer
The pod deployment includes some examples of configuring the server properties via environment variables:
env:
- name: EULA
value: "TRUE"
- name: GAMEMODE
value: survival
- name: DIFFICULTY
value: normalThe file is deploy-able as-is on most clusters, but has been confirmed on Docker for Desktop and Google Kubernetes Engine:
kubectl apply -f examples/kubernetes.ymlYou can follow the logs of the deployment using:
kubectl logs -f deployment/bds- kaiede/minecraft-bedrock-backup image by @Kaiede
- ghcr.io/edward3h/mc-webhook by @edward3h
- Minecraft Bedrock Server Bridge by @macchie
- Admincraft by @joanroig
- Bedrock Server Manager Using itzg docker image by @mugh
@TheTinkerDad provides an excellent tutorial on how to host multiple instances on a single port (19132) so that it's discoverable: https://www.youtube.com/watch?v=ds0_ESzjbfs
When trying to build this Docker Image, ensure that all
.shfiles have a end of line sequence ofLFnotCLRFor the build will fail.
