Dockerfile-recursor

   1 # USAGE
   2
   3 #   docker build --build-arg MAKEFLAGS=-j8 -t recursor -f docker/Dockerfile-recursor .
   4 #   docker run -p 1053:53 -p 1053:53/udp -ti --rm recursor
   5 #   dig a www.example.com @0 -p 1053
   6
   7 # Builder
   8 FROM debian:10-slim AS builder
   9
  10 # Reusable layer for base update
  11 RUN apt-get update && apt-get -y dist-upgrade && apt-get clean
  12
  13 # devscripts gives us mk-build-deps (and a lot of other stuff)
  14 RUN apt-get install -y --no-install-recommends devscripts equivs git curl && apt-get clean
  15
  16 COPY builder-support /source/builder-support
  17
  18 # TODO: control file is not in tarballs at all right now
  19 RUN mk-build-deps -i -t 'apt-get -y -o Debug::pkgProblemResolver=yes --no-install-recommends' /source/builder-support/debian/recursor/debian-buster/control && \
  20     apt-get clean
  21
  22 COPY pdns /source/pdns
  23 COPY build-aux /source/build-aux
  24 COPY m4 /source/m4
  25 COPY ext /source/ext
  26 COPY .git /source/.git
  27 COPY builder/helpers/set-configure-ac-version.sh /usr/local/bin
  28
  29 # build and install (TODO: before we hit this line, rearrange /source structure if we are coming from a tarball)
  30 WORKDIR /source/pdns/recursordist
  31
  32 ARG MAKEFLAGS=
  33 ENV MAKEFLAGS ${MAKEFLAGS:--j2}
  34
  35 ARG DOCKER_FAKE_RELEASE=NO
  36 ENV DOCKER_FAKE_RELEASE ${DOCKER_FAKE_RELEASE}
  37
  38 # Manpage deps
  39 # RUN apt-get install -y python3-venv && apt-get clean
  40
  41 # Manpage prevent
  42 RUN touch pdns_recursor.1 rec_control.1 # avoid installing pandoc
  43
  44 RUN if [ "${DOCKER_FAKE_RELEASE}" = "YES" ]; then \
  45       BUILDER_VERSION="$(IS_RELEASE=YES BUILDER_MODULES=recursor ./builder-support/gen-version | sed 's/\([0-9]\+\.[0-9]\+\.[0-9]\+\(\(alpha|beta|rc\)\d\+\)\)?.*/\1/')" set-configure-ac-version.sh;\
  46     fi && \
  47     BUILDER_MODULES=recursor autoreconf -vfi
  48
  49 RUN mkdir /build && \
  50     ./configure \
  51       --with-lua=luajit \
  52       LDFLAGS=-rdynamic \
  53       --sysconfdir=/etc/powerdns \
  54       --enable-option-checking=fatal && \
  55       make clean && \
  56       make $MAKEFLAGS install DESTDIR=/build && make clean && \
  57       strip /build/usr/local/bin/* /build/usr/local/sbin/*
  58 RUN cd /tmp && mkdir /build/tmp/ && mkdir debian && \
  59     echo 'Source: docker-deps-for-pdns' > debian/control && \
  60     dpkg-shlibdeps /build/usr/local/bin/rec_control /build/usr/local/sbin/pdns_recursor && \
  61     sed 's/^shlibs:Depends=/Depends: /' debian/substvars >> debian/control && \
  62     equivs-build debian/control && \
  63     dpkg-deb -I equivs-dummy_1.0_all.deb && cp equivs-dummy_1.0_all.deb /build/tmp/
  64
  65 # Runtime
  66 FROM debian:10-slim
  67
  68 # Reusable layer for base update - Should be cached from builder
  69 RUN apt-get update && apt-get -y dist-upgrade && apt-get clean
  70
  71 # Ensure python3 and jinja2 is present (for startup script), and tini for signal management
  72 RUN apt-get install -y python3 python3-jinja2 tini libcap2-bin && apt-get clean
  73
  74 # Executables from builder
  75 COPY --from=builder /build /
  76 RUN chmod 1777 /tmp # FIXME: better not use /build/tmp for equivs at all
  77 RUN setcap 'cap_net_bind_service=+eip' /usr/local/sbin/pdns_recursor
  78
  79 # Ensure dependencies are present
  80 RUN apt install -y /tmp/equivs-dummy_1.0_all.deb && apt clean
  81
  82 # Start script
  83 COPY dockerdata/startup.py /usr/local/sbin/pdns_recursor-startup
  84
  85 # Config file(s) from builder
  86 COPY dockerdata/recursor.conf /etc/powerdns/
  87
  88 # Is recursor.d necessary if we copy the config into recursor.conf? (see above)
  89 RUN mkdir -p /etc/powerdns/recursor.d /var/run/pdns-recursor /etc/powerdns/templates.d
  90
  91 # Work with pdns user - not root
  92 RUN adduser --system --disabled-password --disabled-login --no-create-home --group pdns --uid 953
  93 RUN chown pdns:pdns /var/run/pdns-recursor /etc/powerdns/recursor.d /etc/powerdns/templates.d
  94 USER pdns
  95
  96 # DNS ports
  97 EXPOSE 53/udp
  98 EXPOSE 53/tcp
  99
 100 # webserver port
 101 EXPOSE 8082/tcp
 102
 103 ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/sbin/pdns_recursor-startup"]