Security and Stability Considerations for Modded Bissect Hosting in Valheim

High-Risk Mods and Their Security Implications

Critical Risk Mods (Avoid Completely)
These mods either contain known exploits, provide unauthorized access, or have been flagged as malicious by the Valheim modding community.

• Mods Enabling Command Injection or Remote Code Execution (RCE):
  
• Example: "Valheim Admin Tools" (unofficial forks with embedded backdoors)
• Risk: Allows attackers to execute arbitrary system commands on the host, bypassing container isolation. Historically, such mods have been used to deploy cryptominers or lateral movement tools in shared hosting environments.

Mitigation: Bissect’s user namespace remapping (via `--userns-remap`) can restrict container access to `/proc` and `/sys`, but these mods should never be installed due to inherent design flaws.
• Mods with Hardcoded Credentials or Weak Authentication:
  
• Example: "Custom Server Auth Bypass" (mods claiming to "add admin accounts" without encryption)
• Risk: Exposes Bissect’s underlying authentication systems (e.g., SSH keys, API tokens) if the mod leaks credentials or fails to validate inputs. In 2022, a similar mod for another game leaked admin passwords in plaintext logs, leading to server hijacking.
• Network Flooding or DDoS-Facilitating Mods:
  
• Example: "Spam Packet Generator" (mods labeled as "fun" but designed to overload clients or proxies)
• Risk: Can saturate Bissect’s bandwidth quotas or trigger anti-abuse measures, resulting in temporary server bans. One Valheim modded server on a similar platform was terminated after a mod-induced UDP flood targeted a rival server.
• Mods with Unverified or Abandoned Codebases:
  
• Example: "OldWorldEditor" (unmaintained since 2020, with known buffer overflow vulnerabilities)
• Risk: Outdated dependencies (e.g., Newtonsoft.Json < 12.0.3) may contain unpatched CVEs. Bissect’s automated security scans may flag such mods during deployment.
• Mods Altering Core Valheim Binary or DLL Files:
  
• Example: "Direct Memory Patchers" (mods injecting hooks into `valheim_server.x86_64`)
• Risk: Violates Bissect’s immutable base image policy and can crash the server or corrupt game state. Direct binary modification is unsupported and may trigger container health checks.

Moderate Risk Mods (Use with Caution and Isolation)
These mods may not be inherently malicious but introduce stability or compatibility risks if misconfigured. They require additional safeguards, such as read-only filesystem mounts or restricted permissions.

• Mods with File System Write Access:
  
• Example: "Dynamic World Saver" (mods auto-backing up worlds to `/data`)
• Risk: If the mod writes to shared volumes or host paths, it could overwrite critical Bissect configuration files (e.g., `docker-compose.yml`). Always restrict to `/app/mods/` with `noexec` flags.
• Mods with Custom Network Protocols:
  
• Example: "Teleportation Plugins" (mods adding UDP-based teleport commands)
• Risk: May conflict with Bissect’s built-in firewall rules (e.g., `ufw` or `iptables`). Requires explicit whitelisting in the container’s `network.policies`.
• Mods with Deprecated API Dependencies:
  
• Example: "Old BepInEx Hooks" (mods using pre-5.4.21 API calls)
• Risk: Can destabilize the server if Bissect’s Valheim version updates without backward compatibility. Test in staging first.

Sandboxing Mod Execution Using Bissect’s Isolation Features

Core Isolation Principles
1. Container Runtime Security: Use Docker’s `--read-only`, `--tmpfs`, and `--cap-drop` flags to limit mod access.
2. User Namespace Remapping: Restrict container users to unprivileged UIDs (e.g., `1000:1000`).
3. Seccomp/BPF Profiles: Block system calls like `execve`, `mount`, or `ptrace`.
4. Filesystem Mounts: Isolate mods to `/app/mods/` with `bind` mounts and `noexec` attributes.

• Step 1: Configure Docker for Modded Containers
  Modify the Bissect-provided `docker-compose.yml` to include security directives:

  services:
  valheim:
  image: bissecthosting/valheim:latest
  security_opt:
  

• "no-new-privileges:true"
• "seccomp:default.json" # Replace with custom profile
user: "1000:1000" # Unprivileged user
read_only: true # Default; override for writable paths
tmpfs:

• /tmp # Ephemeral storage for mods
volumes:

• ./mods:/app/mods:ro # Read-only mod directory
• ./worlds:/opt/valheim # Persistent world data

Note: The `read_only: true` flag prevents mods from writing to the container filesystem except where explicitly mounted (e.g., `/opt/valheim` for worlds).

• Step 2: Implement User Namespace Remapping
  Enable user namespace isolation to prevent mods from accessing host UIDs:

  # In Bissect’s control panel, add this to the container launch args:
  --userns-remap="default" # Maps container UID 0 to host UID 65534

  This ensures that even if a mod attempts to escalate privileges, it operates under a restricted user context.

• Step 3: Restrict Filesystem Access with `noexec` and `nosuid`
  Mount mod directories with security flags:

  # Example fstab entry (if using host mounts)
  /path/to/mods /app/mods none bind,noexec,nosuid,ro 0 0

  This prevents mods from executing binaries or setting SUID bits, which are common attack vectors.

• Step 4: Deploy a Custom Seccomp Profile
  Create a profile (`mod-seccomp.json`) to block dangerous syscalls:

  {
  "defaultAction": "SCMP_ACT_ERRNO",
  "syscalls": [
  { "names": ["execve", "ptrace"], "action": "SCMP_ACT_ALLOW" },
  { "names": ["mount", "pivot_root"], "action": "SCMP_ACT_ERRNO" },
  { "names": ["keyctl"], "action": "SCMP_ACT_ERRNO" }
  ]
  }

  Apply it via:

  security_opt:
  

• "seccomp=mod-seccomp.json"

Staging Workflow for Mod Deployment with Rollback Procedures

Successfully integrating mods into Bissect Hosting transforms Valheim servers into dynamic, player-centric environments while demanding meticulous planning around compatibility, performance, and security. By adhering to the outlined checklists, configuration best practices, and resource-monitoring techniques, administrators can mitigate common pitfalls such as crashes or latency spikes. The key lies in treating mod deployment as a systematic process—testing in staging, validating dependencies, and leveraging Bissect’s isolation features to contain risks. With these strategies, modded Valheim servers on Bissect Hosting achieve a harmonious blend of creativity and stability, delivering immersive experiences without sacrificing server integrity.

• bissect hosting setup
• mod security
• performance optimization
• server configuration
• valheim modding