steamcmd fails to run after updating

[ScarlettHoefler]

I am running the steamcmd Docker container as part of our CI/CD setup. We've been using it for years, but it's been failing since late last week. Essentially, steamcmd runs and triggers an update, but then hangs after restarting.

The failures started appearing on April 30, 2026. Here's a log from today of an image SHA that was used and failed:

Using effective pull policy of [always] for container cm2network/steamcmd:latest
Using docker image sha256:45f6515d6c4dcde659c9ad6872bdbeacd1bf5c4e7f241829c4d2f28fb5eda581 for cm2network/steamcmd:latest with digest cm2network/steamcmd@sha256:45f6515d6c4dcde659c9ad6872bdbeacd1bf5c4e7f241829c4d2f28fb5eda581 ...

(NOTE: I've also tried separately setting up steamcmd manually on a Ubuntu image as a workaround, but it runs into the same issue. Not sure how to fix it, but I wanted to post it here in case the fix is somehow related to setting up an image or libraries correctly, since the Dockerfile appears to be picking specific library versions)

In essence, our logs look something like this, where STEAM_CMD_PATH is set to /home/steam/steamcmd/steamcmd.sh:

$ timeout 120 $STEAM_CMD_PATH +quit || true
Redirecting stderr to '/home/steam/Steam/logs/stderr.txt'
Logging directory: '/home/steam/Steam/logs'
[  0%] Checking for available updates...
[----] Downloading update (0 of 36,457 KB)...
[  0%] Downloading update (1,244 of 36,457 KB)...
[  3%] Downloading update (4,224 of 36,457 KB)...
[ 11%] Downloading update (7,318 of 36,457 KB)...
[ 20%] Downloading update (9,825 of 36,457 KB)...
[ 26%] Downloading update (12,081 of 36,457 KB)...
[ 33%] Downloading update (13,969 of 36,457 KB)...
[ 38%] Downloading update (15,745 of 36,457 KB)...
[ 43%] Downloading update (17,745 of 36,457 KB)...
[ 48%] Downloading update (19,603 of 36,457 KB)...
[ 53%] Downloading update (21,457 of 36,457 KB)...
[ 58%] Downloading update (23,521 of 36,457 KB)...
[ 64%] Downloading update (25,263 of 36,457 KB)...
[ 69%] Downloading update (26,047 of 36,457 KB)...
[ 71%] Downloading update (27,151 of 36,457 KB)...
[ 74%] Downloading update (28,095 of 36,457 KB)...
[ 77%] Downloading update (29,007 of 36,457 KB)...
[ 79%] Downloading update (29,999 of 36,457 KB)...
[ 82%] Downloading update (30,892 of 36,457 KB)...
[ 84%] Downloading update (31,874 of 36,457 KB)...
[ 87%] Downloading update (32,685 of 36,457 KB)...
[ 89%] Downloading update (33,683 of 36,457 KB)...
[ 92%] Downloading update (34,665 of 36,457 KB)...
[ 95%] Downloading update (35,572 of 36,457 KB)...
[ 97%] Downloading update (36,351 of 36,457 KB)...
[ 99%] Downloading update (36,457 of 36,457 KB)...
[100%] Download complete.
[----] Installing update...
[----] Extracting package...
[----] Extracting package...
[----] Extracting package...
[----] Extracting package...
[----] Installing update...
[----] Installing update...
[----] Installing update...
[----] Installing update...
[----] Installing update...
[----] Installing update...
[----] Installing update...
[----] Installing update...
[----] Installing update...
[----] Cleaning up...
[----] Update complete, launching Steamcmd...
UpdateUI: skip show logo
steamcmd.sh[16]: Restarting steamcmd by request...

(I'm running it through timeout in this instance because it would just sit there for two hours after until the entire job timed out)

I also tried calling steamcmd again after the timeout would cancel the copy that's hanging, but that also led to it hanging with no further console output nor log output. /home/steam/Steam/logs/stderr.txt was an empty file as well.

Our setup is using a GitLab Runner host machine running Ubuntu 22.04 via this DigitalOcean droplet config: https://marketplace.digitalocean.com/apps/docker

Our GitLab job configuration always pulls the latest image; you can see an example full config of a very simple build job here. I picked this one because it's an extremely minimal repro case:

util-SteamRequestGuardCode:
  when: manual
  stage: setup
  timeout: 15m
  image:
    name: cm2network/steamcmd:latest
    pull_policy: always
  tags:
  - linux-docker
  variables:
    STEAM_CMD_PATH: "/home/steam/steamcmd/steamcmd.sh"
    CACHE_FALLBACK_KEY: NONE
  cache: {}
  script:
  - $STEAM_CMD_PATH +login "${STEAM_BUILD_USER}" "${STEAM_BUILD_PASS}" +quit
    || exit_code=$?
  - echo "Steam Guard confirmation code should be sent to whatever STEAM_BUILD_USER
    is configured! Run steam-Login-With-Guard with a STEAM_GUARD_CODE variable set"

I've also attempted to run steamcmd with strace to see if maybe there's a syscall hanging or something, but it's not installed in the image.

[ScarlettHoefler]

For an additional data point, I've also tried running the latest steam-bookworm image and it doesn't try to update, but instead immediately hangs upon trying to run.

Here's the log output with the Docker image SHA for that one:

Pulling docker image cm2network/steamcmd:steam-bookworm ...
Using docker image sha256:abb83dd252fe74b1ebf1269ac9fc546b9ceb59772a3b6d48fc5dede09edbb71d for cm2network/steamcmd:steam-bookworm with digest cm2network/steamcmd@sha256:abb83dd252fe74b1ebf1269ac9fc546b9ceb59772a3b6d48fc5dede09edbb71d ...

[skaryus]

This could be #78

[ScarlettHoefler]

This could be #78

To test this, I've tried adding the following to our runner's config.toml, but it didn't fix the issue:

[[runners]]
  ...
  [runners.docker]
  ...
    security_opt = ["seccomp:unconfined"]

I also tried setting seccomp to the contents of the file linked in #78 but that also didn't fix it; I still see the same behavior. However, given the timing of our jobs breaking on April 30th, which is when the seccomp change was made, it sounds like they could still somehow be related?