While Minecraft can be run a few different ways, I recommend using Java Edition via the Prism Launcher Flatpak, which offers native performance, a stable login flow, and isolates your system from vulnerabilities in Minecraft and Java.

Setup

Prior to setup, set up a managed Microsoft account for your child, and from that account, obtain a Minecraft Java Edition license.

As the administrator user:

1. Install Flatpak
2. Install Prism Launcher

As the child user in a standard desktop environment:

1. Launch Prism Launcher and sign into the child's Microsoft account
2. Add an instance (including mods if desired)
3. Add custom servers if desired (recommended even for single player -- see below)

Configuration

Prism Launcher is configured as a standard type = "flatpak" entry. As it can be addictive for children and adults alike, my configuration is particularly strict when it comes to time limits and cooldowns:

[[entries]]
id = "minecraft"
label = "Minecraft"
icon = "~/.minecraft/launcher/icons/minecraft256.png"

[entries.kind]
type = "flatpak"
app_id = "org.prismlauncher.PrismLauncher"

[entries.availability]

[[entries.availability.windows]]
days = "weekdays"
start = "07:30"
end = "20:30"

[[entries.availability.windows]]
days = "weekends"
start = "07:30"
end = "20:30"

[entries.limits]
max_run_seconds = 1800  # 30 minutes (roughly 3 in-game days)
daily_quota_seconds = 3600  # 1 hour per day
cooldown_seconds = 600  # 10 minute cooldown

[[entries.warnings]]
seconds_before = 600
severity = "info"
message = "10 minutes left - start wrapping up!"

[[entries.warnings]]
seconds_before = 120
severity = "warn"
message = "2 minutes remaining - save your game!"

[[entries.warnings]]
seconds_before = 30
severity = "critical"
message = "30 seconds! Save NOW!"

It should be possible to provide arguments to Prism Launcher that make it launch a specific instance and world, though I have not looked into this.

Regarding servers

The "30 seconds! Save NOW!" message above is critical. Since Prism Launcher is running as a plain flatpak, the shepherdd management service will unceremoniously terminate its cgroup -- it's not too different from immediately removing power. If the user does not manually close their single player world during this message, they risk losing the last few seconds of play at best or chunk corruption at worst.

Instead, I recommend hosting a server on your local network and having the child connect to that. A persistent server will not corrupt on an abrupt disconnect, and hosting it locally ensures that only members of your household can join.

The Docker Compose configuration below will set up a server that includes interoperability with Bedrock Edition via GeyserMC for other family members on Android, iOS, and ChromeOS to join.

services:
  mc:
    image: itzg/minecraft-server
    tty: true
    stdin_open: true
    ports:
      - "25565:25565"
      - "19132:19132/udp"
    environment:
      EULA: "TRUE"
      TYPE: "PAPER"
      MEMORY: 4G
      VIEW_DISTANCE: 32
      SIMULATION_DISTANCE: 32
      PLUGINS: |
        https://download.geysermc.org/v2/projects/geyser/versions/latest/builds/latest/downloads/spigot
        https://download.geysermc.org/v2/projects/floodgate/versions/latest/builds/latest/downloads/spigot
      OPS:
    volumes:
      # attach the relative directory 'data' to the container's /data path
      # if you have an existing world you want to import, put it in 'data'
      - ./data:/data