Dockerfile-dnsdist

   1 # our chosen base image
   2 FROM debian:12-slim AS builder
   3
   4 ENV NO_LUA_JIT="s390x arm64"
   5
   6 # TODO: make sure /source looks roughly the same from git or tar
   7
   8 # Reusable layer for base update
   9 RUN apt-get update && apt-get -y dist-upgrade && apt-get clean
  10
  11 # Unable backports to get a recent enough version of meson
  12 RUN echo "deb http://deb.debian.org/debian bookworm-backports main" > /etc/apt/sources.list.d/bookworm-backports.list
  13 # devscripts gives us mk-build-deps (and a lot of other stuff)
  14 RUN apt-get update && apt-get -y dist-upgrade && apt-get install -y  --no-install-recommends devscripts equivs git && apt-get clean
  15
  16 COPY builder-support /source/builder-support
  17
  18 # TODO: control file is not in tarballs at all right now
  19 RUN mk-build-deps -i -t 'apt-get -y -o Debug::pkgProblemResolver=yes --no-install-recommends' /source/builder-support/debian/dnsdist/debian-bookworm/control && \
  20     apt-get install -y -t bookworm-backports meson && \
  21     apt-get clean
  22
  23 COPY meson /source/meson
  24 COPY pdns /source/pdns
  25 COPY build-aux /source/build-aux
  26 COPY m4 /source/m4
  27 COPY ext /source/ext
  28 COPY builder/helpers/set-configure-ac-version.sh /usr/local/bin
  29 COPY .git /source/.git
  30
  31 # build and install (TODO: before we hit this line, rearrange /source structure if we are coming from a tarball)
  32 WORKDIR /source/pdns/dnsdistdist
  33
  34 ARG MAKEFLAGS=
  35 ENV MAKEFLAGS=${MAKEFLAGS:--j2}
  36
  37 ARG DOCKER_FAKE_RELEASE=NO
  38 ENV DOCKER_FAKE_RELEASE=${DOCKER_FAKE_RELEASE}
  39
  40 RUN touch dnsdist.1 # avoid having to install pandoc and venv
  41
  42 RUN if [ "${DOCKER_FAKE_RELEASE}" = "YES" ]; then \
  43       BUILDER_VERSION="$(IS_RELEASE=YES BUILDER_MODULES=dnsdist ./builder-support/gen-version | sed 's/\([0-9]\+\.[0-9]\+\.[0-9]\+\(\(alpha|beta|rc\)\d\+\)\)?.*/\1/')" set-configure-ac-version.sh;\
  44     fi && \
  45     BUILDER_MODULES=dnsdist autoreconf -vfi
  46
  47 RUN mkdir /quiche && cd /quiche && \
  48     apt-get install -y cmake curl jq libclang-dev && \
  49     apt-get clean && \
  50     cd /source/builder-support/helpers/ && \
  51     ./install_rust.sh && \
  52     ./install_quiche.sh
  53
  54 RUN mkdir /build && \
  55     LUAVER=$([ -z "${NO_LUA_JIT##*$(dpkg --print-architecture)*}" ] && echo 'lua5.3' || echo 'luajit') && \
  56     apt-get install -y lib${LUAVER}-*dev ninja-build && \
  57     BUILDDIR=$(mktemp -d) && \
  58     IS_RELEASE="${DOCKER_FAKE_RELEASE}" \
  59     LDFLAGS="-latomic -fuse-ld=lld -Wl,--build-id=sha1 -ldl" \
  60     CC=clang \
  61     CXX=clang++ \
  62     PKG_CONFIG_PATH=/opt/lib/pkgconfig meson setup ${BUILDDIR} \
  63       --sysconfdir=/etc/dnsdist \
  64       -Dlua=auto \
  65       -Db_lto=true \
  66       -Db_lto_mode=thin \
  67       -Db_pie=true \
  68       -Ddns-over-https=enabled \
  69       -Ddns-over-quic=enabled \
  70       -Ddns-over-http3=enabled \
  71       -Ddns-over-tls=enabled \
  72       -Ddnscrypt=enabled \
  73       -Ddnstap=enabled \
  74       -Dyaml=enabled \
  75       -Debpf=enabled \
  76       -Dyaml=enabled \
  77       -Dtls-gnutls=enabled \
  78       -Dsnmp=enabled \
  79       -Dlibcap=enabled \
  80       -Dlibsodium=enabled \
  81       -Dquiche=enabled \
  82       -Dre2=enabled \
  83       -Dsystemd-service=disabled \
  84       -Dxsk=enabled && \
  85     meson compile -C ${BUILDDIR} && \
  86     meson install -C ${BUILDDIR} --destdir /build && \
  87     strip /build/usr/local/bin/* && \
  88     rm -rf /build/lib # remove systemd unit files, we do not need them and copying /lib to the run-time image breaks it
  89
  90 RUN for tentative in "lib/x86_64-linux-gnu" "lib/aarch64-linux-gnu" "lib64" "lib"; do \
  91       if [ -f "/usr/${tentative}/libdnsdist-quiche.so" ]; then \
  92         mkdir -p "/build/usr/${tentative}/"; \
  93         cp "/usr/${tentative}/libdnsdist-quiche.so" "/build/usr/${tentative}/"; \
  94         break; \
  95       fi; \
  96     done
  97
  98 RUN cd /tmp && mkdir /build/tmp/ && mkdir debian && \
  99     echo 'Source: docker-deps-for-pdns' > debian/control && \
 100     dpkg-shlibdeps /build/usr/local/bin/dnsdist && \
 101     sed 's/^shlibs:Depends=/Depends: /' debian/substvars >> debian/control && \
 102     equivs-build debian/control && \
 103     dpkg-deb -I equivs-dummy_1.0_all.deb && cp equivs-dummy_1.0_all.deb /build/tmp/
 104
 105 # Runtime
 106
 107 FROM debian:12-slim
 108
 109 # Reusable layer for base update - Should be cached from builder
 110 RUN apt-get update && apt-get -y dist-upgrade && apt-get clean
 111
 112 # - python3 and jinja2 (for startup script)
 113 # - tini (for signal management)
 114 # - ca-certificates (for verifying downstream DoH/DoT certificates)
 115 RUN apt-get install -y python3 python3-jinja2 tini libcap2-bin ca-certificates && apt-get clean
 116
 117 # Output from builder
 118 COPY --from=builder /build /
 119 RUN chmod 1777 /tmp # FIXME: better not use /build/tmp for equivs at all
 120
 121 # Ensure dependencies are present
 122 RUN apt-get install -y /tmp/equivs-dummy_1.0_all.deb && apt-get clean
 123
 124 # Config
 125 RUN mkdir -p /etc/dnsdist/conf.d /etc/dnsdist/templates.d
 126 COPY dockerdata/dnsdist.conf /etc/dnsdist/
 127
 128 # Start script
 129 COPY dockerdata/startup.py /usr/local/bin/dnsdist-startup
 130
 131 # Work with pdns user - not root
 132 RUN adduser --system --disabled-password --disabled-login --no-create-home --group pdns --uid 953
 133 RUN chown pdns:pdns /etc/dnsdist/conf.d /etc/dnsdist/templates.d
 134 USER pdns
 135
 136 # Default DNS ports
 137 EXPOSE 53/udp
 138 EXPOSE 53/tcp
 139 # Default console port
 140 EXPOSE 5199/tcp
 141 # Default webserver port
 142 EXPOSE 8083/tcp
 143
 144 WORKDIR /etc/dnsdist
 145
 146 COPY dockerdata/dnsdist-resolver.lua /etc/dnsdist/
 147
 148 ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/dnsdist-startup"]