Dockerfile-dnsdist

   1 # our chosen base image
   2 FROM debian:10-slim AS builder
   3
   4 ENV NO_LUA_JIT="s390x arm64"
   5
   6 # TODO: make sure /source looks roughly the same from git or tar
   7
   8 # Reusable layer for base update
   9 RUN apt-get update && apt-get -y dist-upgrade && apt-get clean
  10
  11 # devscripts gives us mk-build-deps (and a lot of other stuff)
  12 RUN apt-get update && apt-get -y dist-upgrade && apt-get install -y  --no-install-recommends devscripts equivs git && apt-get clean
  13
  14 COPY builder-support /source/builder-support
  15
  16 # TODO: control file is not in tarballs at all right now
  17 RUN mk-build-deps -i -t 'apt-get -y -o Debug::pkgProblemResolver=yes --no-install-recommends' /source/builder-support/debian/dnsdist/debian-buster/control && \
  18     apt-get clean
  19
  20 COPY pdns /source/pdns
  21 COPY build-aux /source/build-aux
  22 COPY m4 /source/m4
  23 COPY ext /source/ext
  24 COPY builder/helpers/set-configure-ac-version.sh /usr/local/bin
  25 COPY .git /source/.git
  26
  27 # build and install (TODO: before we hit this line, rearrange /source structure if we are coming from a tarball)
  28 WORKDIR /source/pdns/dnsdistdist
  29
  30 ARG MAKEFLAGS=
  31 ENV MAKEFLAGS ${MAKEFLAGS:--j2}
  32
  33 ARG DOCKER_FAKE_RELEASE=NO
  34 ENV DOCKER_FAKE_RELEASE ${DOCKER_FAKE_RELEASE}
  35
  36 RUN touch dnsdist.1 # avoid having to install pandoc and venv
  37
  38 RUN if [ "${DOCKER_FAKE_RELEASE}" = "YES" ]; then \
  39       BUILDER_VERSION="$(IS_RELEASE=YES BUILDER_MODULES=dnsdist ./builder-support/gen-version | sed 's/\([0-9]\+\.[0-9]\+\.[0-9]\+\(\(alpha|beta|rc\)\d\+\)\)?.*/\1/')" set-configure-ac-version.sh;\
  40     fi && \
  41     BUILDER_MODULES=dnsdist autoreconf -vfi
  42
  43 RUN mkdir /build && \
  44     LUAVER=$([ -z "${NO_LUA_JIT##*$(dpkg --print-architecture)*}" ] && echo 'lua5.3' || echo 'luajit') && \
  45     ./configure \
  46       --with-lua=${LUAVER} \
  47       LDFLAGS=-rdynamic \
  48       --sysconfdir=/etc/dnsdist \
  49       --enable-option-checking=fatal \
  50       --enable-dnscrypt \
  51       --enable-dns-over-tls \
  52       --enable-dns-over-https \
  53       --with-re2 && \
  54     make clean && \
  55     make $MAKEFLAGS install DESTDIR=/build && make clean && \
  56     strip /build/usr/local/bin/*
  57 RUN cd /tmp && mkdir /build/tmp/ && mkdir debian && \
  58     echo 'Source: docker-deps-for-pdns' > debian/control && \
  59     dpkg-shlibdeps /build/usr/local/bin/dnsdist && \
  60     sed 's/^shlibs:Depends=/Depends: /' debian/substvars >> debian/control && \
  61     equivs-build debian/control && \
  62     dpkg-deb -I equivs-dummy_1.0_all.deb && cp equivs-dummy_1.0_all.deb /build/tmp/
  63
  64 # Runtime
  65
  66 FROM debian:10-slim
  67
  68 # Reusable layer for base update - Should be cached from builder
  69 RUN apt-get update && apt-get -y dist-upgrade && apt-get clean
  70
  71 # Ensure python3 and jinja2 is present (for startup script), and python3-atomicwrites (for backend management), and tini (for signal management)
  72 RUN apt-get install -y python3 python3-jinja2 python3-atomicwrites tini libcap2-bin && apt-get clean
  73
  74 # Output from builder
  75 COPY --from=builder /build /
  76 RUN chmod 1777 /tmp # FIXME: better not use /build/tmp for equivs at all
  77 RUN setcap 'cap_net_bind_service=+eip' /usr/local/bin/dnsdist
  78
  79 # Ensure dependencies are present
  80 RUN apt install -y /tmp/equivs-dummy_1.0_all.deb && apt clean
  81
  82 # Config
  83 RUN mkdir -p /etc/dnsdist/conf.d /etc/dnsdist/templates.d
  84 COPY dockerdata/dnsdist.conf /etc/dnsdist/
  85
  86 # Start script
  87 COPY dockerdata/startup.py /usr/local/bin/dnsdist-startup
  88
  89 # Work with pdns user - not root
  90 RUN adduser --system --disabled-password --disabled-login --no-create-home --group pdns --uid 953
  91 RUN chown pdns:pdns /etc/dnsdist/conf.d /etc/dnsdist/templates.d
  92 USER pdns
  93
  94 # DNS ports
  95 EXPOSE 53/udp
  96 EXPOSE 53/tcp
  97 # console port
  98 EXPOSE 5199/tcp
  99 # webserver port
 100 EXPOSE 8083/tcp
 101
 102 WORKDIR /etc/dnsdist
 103
 104 COPY dockerdata/dnsdist-resolver.lua /etc/dnsdist/
 105 COPY dockerdata/dnsdist-resolver.py /usr/local/bin/dnsdist-resolver
 106
 107 ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/dnsdist-startup"]