Dockerfile-dnsdist

   1 # our chosen base image
   2 FROM debian:10-slim AS builder
   3
   4 # TODO: make sure /source looks roughly the same from git or tar
   5
   6 # Reusable layer for base update
   7 RUN apt-get update && apt-get -y dist-upgrade && apt-get clean
   8
   9 # devscripts gives us mk-build-deps (and a lot of other stuff)
  10 RUN apt-get update && apt-get -y dist-upgrade && apt-get install -y  --no-install-recommends devscripts equivs git && apt-get clean
  11
  12 # import everything - this could be pdns.git OR a dnsdist tarball!
  13 COPY . /source
  14
  15 # TODO: control file is not in tarballs at all right now
  16 RUN mk-build-deps -i -t 'apt-get -y -o Debug::pkgProblemResolver=yes --no-install-recommends' /source/builder-support/debian/dnsdist/debian-buster/control && \
  17     apt-get clean
  18
  19 # build and install (TODO: before we hit this line, rearrange /source structure if we are coming from a tarball)
  20 WORKDIR /source/pdns/dnsdistdist
  21
  22 ARG MAKEFLAGS=
  23 ENV MAKEFLAGS ${MAKEFLAGS:--j2}
  24
  25 RUN touch dnsdist.1 # avoid having to install pandoc and venv
  26
  27 RUN BUILDER_MODULES=dnsdist autoreconf -vfi
  28
  29 RUN mkdir /build && \
  30     ./configure \
  31       --with-lua=luajit \
  32       LDFLAGS=-rdynamic \
  33       --sysconfdir=/etc/dnsdist \
  34       --enable-option-checking=fatal \
  35       --enable-dnscrypt \
  36       --enable-dns-over-tls \
  37       --enable-dns-over-https \
  38       --with-re2 && \
  39     make clean && \
  40     make $MAKEFLAGS install DESTDIR=/build && make clean && \
  41     strip /build/usr/local/bin/*
  42 RUN cd /tmp && mkdir /build/tmp/ && mkdir debian && \
  43     echo 'Source: pdns' > debian/control && \
  44     dpkg-shlibdeps /build/usr/local/bin/dnsdist && \
  45     sed 's/^shlibs:Depends=/Depends: /' debian/substvars >> debian/control && \
  46     equivs-build debian/control && \
  47     dpkg-deb -I equivs-dummy_1.0_all.deb && cp equivs-dummy_1.0_all.deb /build/tmp/
  48
  49 # Runtime
  50
  51 FROM debian:10-slim
  52
  53 # Reusable layer for base update - Should be cached from builder
  54 RUN apt-get update && apt-get -y dist-upgrade && apt-get clean
  55
  56 # Ensure python3 is present (for startup script), and python3-atomicwrites (for backend management), and tini (for signal management)
  57 RUN apt-get install -y python3 python3-atomicwrites tini libcap2-bin && apt-get clean
  58
  59 # Output from builder
  60 COPY --from=builder /build /
  61 RUN chmod 1777 /tmp # FIXME: better not use /build/tmp for equivs at all
  62 RUN setcap 'cap_net_bind_service=+eip' /usr/local/bin/dnsdist
  63
  64 # Ensure dependencies are present
  65 RUN apt install -y /tmp/equivs-dummy_1.0_all.deb && apt clean
  66
  67 # Config
  68 RUN mkdir -p /etc/dnsdist/conf.d
  69 RUN touch /etc/dnsdist-api.conf && chown 953 /etc/dnsdist-api.conf
  70 RUN ln -s /etc/dnsdist-api.conf /etc/dnsdist/conf.d/api.conf
  71 COPY --from=builder /source/dockerdata/dnsdist.conf /etc/dnsdist/
  72
  73 # Start script
  74 COPY dockerdata/startup.py /usr/local/bin/dnsdist-startup
  75
  76 # Work with pdns user - not root
  77 RUN adduser --system --disabled-password --disabled-login --no-create-home --group pdns --uid 953
  78 USER pdns
  79
  80 # DNS ports
  81 EXPOSE 53/udp
  82 EXPOSE 53/tcp
  83 # console port
  84 EXPOSE 5199/tcp
  85 # webserver port
  86 EXPOSE 8083/tcp
  87
  88 WORKDIR /etc/dnsdist
  89
  90 COPY --from=builder /source/dockerdata/dnsdist-resolver.lua /etc/dnsdist/
  91 COPY --from=builder /source/dockerdata/dnsdist-resolver.py /usr/local/bin/dnsdist-resolver
  92
  93 ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/dnsdist-startup"]