You can run a Rust dedicated server in Docker reliably if you treat it as three separate problems: a maintained Rust image, correct UDP/TCP publishing, and storage that survives container replacement. Rust uses UDP for gameplay and Steam queries (typically 28015/udp and 28017/udp) and TCP for RCON (28016/tcp). Mount the image’s server-data directory to a named volume or host directory, set RustDedicated startup parameters, and verify the logs before opening the server to players.
Prefer not to run the server on your own PC? Godlike.Host offers hosted Rust servers with free DDoS protection and up to three free backups a day.
This guide shows a deployment sequence that works with current Docker tooling while leaving image-specific commands and environment-variable names to the image you actually select.
As an Amazon Associate I earn from qualifying purchases.
What you need before creating the container
A container does not remove Rust’s resource or network requirements; it only packages the server process. Prepare the host first.
Hardware and bandwidth
LinuxGSM’s 2023 Rust requirements list 9 GB of RAM minimum, a dual-core 3.4 GHz CPU, and 10 Mbps upload bandwidth. Treat those as a floor for the host, not a guarantee of a particular player count. Docker, the operating system, monitoring, backups, and other services consume part of the machine’s resources, so leave headroom above 9 GB. The available evidence does not establish a universal player capacity for a Dockerized Rust server; capacity depends on map size, plugins, connected players, and host performance.
#1 Best Overall
- Requires overclocking/BIOS adjustments. Maximum speed and performance depends on system components, including motherboard and CPU.
- G.SKILL RipjawsV Series DDR4 U-DIMM Memory Kit, Model: F4-3200C16D-16GVKB
- Non-ECC, DDR4 U-DIMM, 288-pin, for Desktop PC & Gaming
- Includes JEDEC default profile, and Intel XMP memory overclock profile
- Do not mix memory kits. Memory kits are sold in matched kits that are designed to run together as a set. Mixing memory kits will result in stability issues or system failure.
Reserve additional disk space for the Rust installation, downloaded updates, world saves, logs, and backups. A large world or a long-running server can make the persistent data directory grow substantially.
Supported operating system
LinuxGSM lists Ubuntu 24.04 LTS, Debian 11, and RHEL 8 among supported Rust-hosting distributions. Use a currently maintained release of one of these families, apply security updates, and install Docker Engine and the Compose plugin from Docker’s documentation for that distribution.
Administrative access
- Root or equivalent privileges to install Docker, create firewall rules, and create a data directory.
- A public static address or DNS name if players will connect over the internet.
- Permission to configure the upstream firewall or cloud security group as well as the host firewall.
- A backup destination separate from the container’s data volume.
Choose and inspect a Rust server image
The image determines how SteamCMD is installed, where Rust files are stored, which environment variables are supported, and how updates and Oxide/uMod are handled. Select an actively maintained image whose README documents:
- the exact image tag or release strategy;
- the server-data path to mount;
- the entrypoint and supported RustDedicated arguments;
- SteamCMD update behavior and shutdown handling;
- optional Oxide/uMod installation and upgrade behavior;
- health checks, log output, and any required file ownership.
Community images can become incompatible when Facepunch changes Rust. Check recent releases, open issues, and the image’s documented Rust version before production use. Avoid floating blindly on latest if you need repeatable upgrades; pin a tested tag or digest, then change it deliberately during a maintenance window.
Some images expose settings through variables such as a server name, identity, seed, world size, maximum players, and RCON password. Others expect the same values as command-line arguments. The variable names in one image are not portable to another, so copy only the names documented by your selected image.
Create persistent storage before starting Rust
Rust writes saves, maps, configuration, logs, and plugins under its server-data tree. If that tree exists only in the writable layer of a container, deleting or replacing the container can reset the world. Docker identifies volumes as the preferred mechanism for data generated and used by containers.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Named volume
A named volume is managed by Docker and is usually the simplest option for a single host:
Rank #2
- [Color] PCB color may vary (black or green) depending on production batch. Quality and performance remain consistent across all Timetec products.
- DDR3L / DDR3 1600MHz PC3L-12800 / PC3-12800 240-Pin Unbuffered Non-ECC 1.35V / 1.5V CL11 Dual Rank 2Rx8 based 512x8
- Module Size: 16GB KIT(2x8GB Modules) Package: 2x8GB ; JEDEC standard 1.35V, this is a dual voltage piece and can operate at 1.35V or 1.5V
- For DDR3 Desktop Compatible with Intel and AMD CPU, Not for Laptop
- Guaranteed Lifetime warranty from Purchase Date and Free technical support based on United States
docker volume create rust-dataMount that volume at the exact server-data path documented by the image. The example below uses /home/steam/server_data because that is a common image layout; confirm the path in your image’s documentation before starting.
Bind mount
A bind mount keeps files in a host directory, which can make inspection and integration with an existing backup system easier:
sudo mkdir -p /srv/rust/server_data
sudo chown -R 1000:1000 /srv/rust/server_dataThe owner and numeric ID must match the user used by the image. Do not change ownership blindly; inspect the image documentation or run a one-off shell to determine the expected UID.
Back up the volume
Stop the server cleanly before a full backup so the world and configuration are not changing while files are copied. A simple archive workflow for a named volume is:
docker compose stop rust
docker run --rm
-v rust-data:/source:ro
-v /srv/rust-backups:/backup
alpine tar czf /backup/rust-data-$(date +%Y%m%d-%H%M).tar.gz -C /source .
docker compose start rustTest that you can restore an archive to a separate volume. Keep at least one backup outside the Docker host, and take an additional backup before a wipe, image change, or Rust update.
Publish the Rust ports with the right protocols
Rust’s documented example uses 28015/UDP for gameplay, 28017/UDP for Steam queries, and 28016/TCP for RCON. The query port must be distinct from the game port. Docker port publishing requires an explicit protocol suffix when you want to avoid ambiguity.
| Purpose | Container port | Protocol | Typical host mapping | Who needs access |
|---|---|---|---|---|
| Gameplay | 28015 | UDP | 28015:28015/udp | Players |
| Steam query/listing | 28017 | UDP | 28017:28017/udp | Steam server browser and query tools |
| RCON administration | 28016 | TCP | 28016:28016/tcp | Administrators or a private management network |
Published ports are externally reachable by default. Open only the ports you need in Docker, the host firewall, cloud security groups, and any router or NAT rule. Restrict RCON to administrator addresses when possible; exposing it to the entire internet creates an avoidable attack surface.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #3
- [Specs] DDR3L / DDR3 1600MHz PC3L-12800 / PC3-12800 204-Pin Unbuffered Non ECC 1.35V CL11 Dual Rank 2Rx8 based 512x8
- [Size] Module Size: 16GB KIT(2x8GB Modules) Package: 2x8GB
- [Voltage] JEDEC standard 1.35V, this is a dual voltage piece and can operate at 1.35V or 1.5V
- [Compatibility] Compatible with DDR3 Laptop / Notebook PC, Mini PC, All in one Device
- [Color] PCB Color is green
Use a Compose file as a repeatable definition
The following is a minimal shape. The image name, variable names, and data path are illustrative: replace them with the exact interface documented by your selected image. If the image uses command-line arguments instead of environment variables, pass the RustDedicated parameters through its documented command or entrypoint.
services:
rust:
image: your-maintained-rust-image:tag
container_name: rust-server
restart: unless-stopped
ports:
- "28015:28015/udp" # gameplay
- "28017:28017/udp" # Steam query
- "28016:28016/tcp" # RCON
volumes:
- rust-data:/home/steam/server_data
environment:
RUST_SERVER_NAME: "My Rust Server"
RUST_SERVER_IDENTITY: "server1"
RUST_SERVER_SEED: "1234"
RUST_SERVER_WORLD_SIZE: "4000"
RUST_SERVER_MAXPLAYERS: "10"
RUST_RCON_PASSWORD: "change-this-secret"
volumes:
rust-data:Do not commit a real RCON password to a public repository. Use an untracked .env file, Docker secrets where supported by the image, or another secret-management system. Ensure the secret is not printed in shell history, CI logs, or diagnostic output.
Keep host and container ports identical unless you intentionally change the corresponding Rust startup parameter. For example, mapping host port 38015 to container port 28015 is valid, but players must use 38015 and any query or firewall documentation must reflect that choice.
Set RustDedicated startup parameters
Facepunch documents RustDedicated parameters for the server identity, map, seed, world size, player limit, hostname, and RCON. A typical argument set includes:
Free tools Windows power users keep installed
One-click scans. No signup required.
-batchmodeto run without an interactive graphical interface;+server.identity server1to select the identity directory;+server.level Procedural Map(or another documented level) to choose the map;+server.seed 1234for a deterministic procedural seed;+server.worldsize 4000for the map size;+server.maxplayers 10for the connection limit;+server.hostname "My Rust Server"for the browser name;+rcon.port 28016and+rcon.passwordfor RCON;+rcon.web 1when using a web-compatible RCON client.
Use the exact spelling and capitalization expected by the current Rust server documentation and image entrypoint. Keep a small set of identity, network, and RCON arguments on the command line when that makes container configuration clear; place a larger set of gameplay settings in the identity’s cfg/server.cfg file.
Example command-style configuration
An image that passes arguments through to RustDedicated may use a command similar to this one:
-batchmode
+server.identity server1
+server.level "Procedural Map"
+server.seed 1234
+server.worldsize 4000
+server.maxplayers 10
+server.hostname "My Rust Server"
+rcon.port 28016
+rcon.password "$RUST_RCON_PASSWORD"
+rcon.web 1The command is a model of the Rust parameters, not a universal entrypoint. Follow the image’s documented syntax for passing them and for supplying the password securely.
Rank #4
- Disclaimer: Maximum Speed requires overclocking/PC BIOS adjustments. Maximum speed and performance depend on system components, including motherboard and CPU
- Hand-sorted memory chips ensure high performance with generous overclocking headroom
- VENGEANCE LPX is optimized for wide compatibility with the latest Intel and AMD DDR4 motherboards
- A low-profile height of just 34mm ensures that VENGEANCE LPX even fits in most small-form-factor builds
- A solid aluminum heatspreader efficiently dissipates heat from each module so that they consistently run at high clock speeds
Use server.cfg for broader settings
Facepunch states that server.cfg is read from the selected identity’s cfg directory and takes priority for settings placed there. With identity server1, the file is normally beneath that identity’s data directory. Verify the precise path exposed by the image, then edit the file in the persistent mount so it survives container replacement.
Start the container and verify it before inviting players
- Validate the Compose file. Run
docker compose configand inspect the rendered ports, volume, image tag, and environment values. Confirm that no secret is accidentally printed or committed. - Start in the background. Run
docker compose up -d. The image may download SteamCMD components or Rust files on the first run. - Follow the logs. Run
docker compose logs -f rust. Facepunch notes that initial startup can take several minutes and that startup output may contain warnings or errors that are not fatal. Wait for the image and Rust logs to indicate that initialization has completed. - Confirm the mounted data. Run
docker inspect rust-serverand verify that the intended volume is mounted at the documented server-data path. Check that the identity directory, configuration, logs, and world files appear there. - Test locally first. From the host or a permitted test client, verify that RCON works and that the game process remains running. Then test from an external network to catch firewall, NAT, and protocol mistakes.
- Check the listing. If the server should appear in the browser, confirm both gameplay and query UDP mappings and make sure the query port is not the same as the game port.
Do not interpret a running container alone as a ready server. A process can be alive while the wrong port is published, the volume is mounted at the wrong directory, or Rust is still generating the world.
Install Oxide/uMod only after vanilla Rust works
First establish a clean, unmodified Rust server. Then install an Oxide/uMod release that matches the currently installed Rust build. Facepunch and LinuxGSM documentation both emphasize that the framework must track Rust updates.
- Back up the persistent server-data volume.
- Stop the container cleanly with
docker compose stop rust. - Install the matching Oxide/uMod release using the image’s documented option or installation procedure.
- Start the container and watch the logs for framework initialization.
- Place plugin files in the persistent
oxide/pluginsdirectory, not in a disposable container layer. - Enable plugins one at a time and inspect logs after each change.
After a Rust update, assume that Oxide/uMod and plugins may need updates or reapplication. A plugin that worked before the update can fail because an API, assembly, or framework version changed. Use the image’s or LinuxGSM’s documented mods-update workflow where applicable rather than copying an old framework into a new server blindly.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Protect RCON and optional Rust+ connectivity
RCON
RCON is remote administration, not a player-facing service. Set a long, unique password; keep the TCP port behind a firewall rule or private network; and prefer an SSH tunnel or VPN when your administration workflow supports one. The +rcon.web 1 setting is needed by web-compatible RCON clients, but it does not make an internet-wide exposure safe.
Before opening RCON externally, confirm which host address and port the client should use, test authentication from an allowed administrator network, and verify that failed logins and other access attempts are visible in your logs or firewall records.
Rust+
Rust+ is optional. Its companion service needs its configured TCP port reachable. Facepunch documents a default derived from the game or RCON port and recommends checking the active value with app.info. Do not open an additional port merely because Rust is running; enable Rust+, check the active value, publish that TCP port, and add the corresponding firewall rule only when the feature is in use.
Best Value
- Complies with JEDEC standards
- Low voltage of 1.2V for less power consumption
- Strict test and verification procedures are performed for products
- Timing 22-22-22-52
- Backed by a lifetime warranty to promise complete services and technical support
Make restarts and updates predictable
Restart policy
restart: unless-stopped tells Docker to restart the service after a crash and after a Docker daemon restart, unless you deliberately stopped it. Choose a policy intentionally: automatic restarts improve availability, but they can hide a configuration error in a rapid restart loop. During diagnosis, temporarily remove the policy or stop the service so you can read the complete failure output.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRoutine update sequence
- Announce maintenance and stop accepting new players if your community needs notice.
- Run a clean shutdown with
docker compose stop rust. - Back up the persistent volume and record the current image tag, Rust version, framework version, and plugin list.
- Update the image tag or run the image’s documented SteamCMD update procedure.
- Start the container with
docker compose up -d. - Follow
docker compose logs -f rustuntil Rust reports startup completion. - Verify the identity, map, configuration, ports, RCON, and plugins before allowing players back in.
SteamCMD updates can replace vanilla files. Facepunch notes that Oxide must be reapplied or updated after Rust updates, so treat the framework and plugins as part of the maintenance plan rather than as permanent files inside the game installation.
Wipes and world changes
A procedural seed and world size define the generated map, while the identity directory holds the resulting world and configuration. Before a wipe or a change to those parameters, back up the old identity data and record the new seed, world size, and intended wipe date. Do not delete the volume as a shortcut unless you have a verified backup and deliberately want to remove all persistent data.
Troubleshoot the failures that occur most often
The server is not listed
- Confirm that the game port is published as UDP, not only TCP.
- Confirm that the query port is also UDP and is distinct from the game port.
- Check Docker’s rendered configuration with
docker compose config. - Check host and cloud firewall rules, router forwarding, and the public address players are using.
- Read the Rust logs for the actual bound ports and identity.
Players cannot connect, but RCON works
RCON working proves only that the TCP administration path is reachable. Verify the gameplay mapping is host:container/udp, that the host firewall allows UDP, and that the published host port matches the Rust game-port parameter. A TCP-only rule or mapping will not carry player traffic.
The world resets after recreation
Inspect the container mounts and compare the mount destination with the path where the image actually writes saves. If the volume is mounted one directory too high or too low, Rust may be writing to an unpersisted path. Stop the server, locate the identity and save files, correct the mount, and restore the latest known-good backup if necessary.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Plugins fail after an update
Check the Rust build, Oxide/uMod build, and plugin versions together. Install the matching framework release, update incompatible plugins, and read the first error in the log rather than treating every subsequent stack trace as a separate cause. Test changes with one plugin enabled at a time.
The container repeatedly restarts
Run docker logs rust-server and docker inspect rust-server. Check available RAM, disk capacity, file ownership, image architecture, malformed startup arguments, and the reachability of Steam content servers. Temporarily disable the restart policy while diagnosing so Docker does not obscure the initial failure behind repeated restarts.
RCON is reachable from everywhere
Publishing a port without a source restriction exposes it externally by default. Add a firewall allow-list for administrator addresses, move management behind a VPN or SSH tunnel, rotate the RCON password, and remove any unnecessary public mapping.
Compare deployment approaches before committing
Docker is a packaging method, not a guarantee that an image is maintained. Compare the following approaches against the operational needs of your server:
Recommended Free Tools
| Evaluation area | Hand-built Docker image | LinuxGSM inside Docker | Hosted control panel |
|---|---|---|---|
| Image and software maintenance | You own the Dockerfile, base image, SteamCMD flow, and release testing. | LinuxGSM supplies a documented management layer, but you still maintain the container and host. | The provider maintains the platform; verify its Rust version and update policy. |
| Persistence and backups | You design volumes, archives, retention, and restore tests. | You design Docker persistence while using LinuxGSM’s management conventions. | Check whether automated backups, retention, and downloadable restores are included. |
| Networking | You configure UDP gameplay and query ports, TCP RCON, firewalls, and NAT. | Confirm the same Docker mappings and LinuxGSM configuration. | Verify support for UDP query traffic, RCON, custom ports, and a static address. |
| Mods | You control Oxide/uMod installation and plugin files. | LinuxGSM documents a mods-update workflow where applicable. | Check whether the panel supports the framework and lets you recover files. |
| Observability | Use Docker logs, host metrics, and your own alerts. | Use LinuxGSM status and logs in addition to Docker tooling. | Check log retention, console access, and alerting limits. |
| Resource controls | Set Docker and host limits, then monitor for contention. | Use Docker and host controls; LinuxGSM does not replace capacity planning. | Confirm the allocated RAM, CPU policy, disk limits, and upgrade path. |
| DDoS protection and address | Not supplied by Docker; arrange network protection separately. | Not supplied by LinuxGSM itself; verify your network provider. | Ask whether DDoS protection and a static address are included. |
For a self-managed server, Docker is a good fit when you value repeatable configuration, isolated dependencies, and explicit backups. It is a poor fit if you will not monitor resource use, maintain the image, or test restores.
Quick Recap
A practical pre-launch checklist
- The host exceeds LinuxGSM’s 9 GB RAM minimum and has CPU, disk, and upload headroom.
- The selected image has recent maintenance activity and documents its data path and entrypoint.
- A named volume or bind mount contains the server-data directory.
- Backups are automated or scheduled, stored separately, and periodically restored in a test volume.
- Gameplay and query ports are distinct UDP mappings; RCON is a TCP mapping.
- Host, cloud, and router firewall rules match the published ports.
- RCON uses a strong secret and is restricted to trusted networks.
- The identity, map, seed, world size, hostname, and player limit are intentional.
- The Compose file validates without exposing secrets.
- Vanilla Rust starts cleanly before Oxide/uMod or plugins are added.
- The restart policy is deliberate and understood by whoever operates the host.
- The update and wipe procedure includes a clean stop, backup, version record, and post-update log check.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
