Feature · 03

File manager

Direct access to a server's data directory via REST. Path traversal is blocked at the boundary.

01

Where files live

Each server's data lives at /var/mcdata/<id> on the host. Inside the container, that path is mounted at /data. The layout matches what itzg/minecraft-server expects: server.properties, world/, plugins/, logs/, and so on.

02

Endpoints

GET    /api/servers/:id/files?path=/world
GET    /api/servers/:id/files/content?path=/server.properties
PUT    /api/servers/:id/files/content    { path, content }
POST   /api/servers/:id/files/upload     (multipart, field=file)
DELETE /api/servers/:id/files?path=/world/region/r.0.0.mca

Every endpoint sits behind the ServerOwnerGuard. The path query is resolved against the data root with path.resolve and verified to start with the same prefix; anything that escapes is rejected with 403.

03

Limits

Read size
5 MB max for inline preview. Anything larger returns 400; download raw via the upload-equivalent endpoint (planned).
Upload size
100 MB per file (multer limit). Datapacks fit, world archives do not.
Delete root
Refused. DELETE ?path=/ returns 403; use the server delete endpoint to nuke an entire installation.
04

Editing while running

Most config files (server.properties, ops.json, whitelist.json) only take effect after a restart, with the exception of a few that the server reloads on demand. The panel does not stop the server when you save; do that yourself if you need the change live.