docker-builds/unbound-python/Dockerfile at main · ybbapp/docker-builds · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
ARG DEBIAN_VERSION=trixie
ARG UNBOUND_VERSION=1.25.1

FROM debian:${DEBIAN_VERSION}-slim

ARG UNBOUND_VERSION

LABEL org.opencontainers.image.title="unbound-python" \
      org.opencontainers.image.description="Unbound DNS server built from source with cachedb and Python module support" \
      org.opencontainers.image.source="https://github.com/ybbapp/docker-builds"

ENV DEBIAN_FRONTEND=noninteractive

# Build from upstream source, following NLnetLabs/pythonunbound's approach, but
# also enable cachedb so the server can run module-config: "cachedb iterator python".
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
      build-essential \
      ca-certificates \
      curl \
      dns-root-data \
      dnsutils \
      libevent-dev \
      libhiredis-dev \
      libssl-dev \
      pkg-config \
      python3 \
      python3-dev \
      swig && \
    curl -fsSLo /tmp/unbound.tar.gz "https://www.nlnetlabs.nl/downloads/unbound/unbound-${UNBOUND_VERSION}.tar.gz" && \
    mkdir -p /tmp/unbound-src && \
    tar -xzf /tmp/unbound.tar.gz -C /tmp/unbound-src --strip-components=1 && \
    cd /tmp/unbound-src && \
    PYTHON_VERSION=3 ./configure \
      --prefix=/usr/local \
      --sysconfdir=/etc \
      --localstatedir=/var \
      --runstatedir=/run \
      --with-pidfile=/run/unbound/unbound.pid \
      --with-rootkey-file=/usr/share/dns/root.key \
      --with-libevent \
      --with-libhiredis \
      --with-pyunbound \
      --with-pythonmodule \
      --enable-cachedb && \
    make -j"$(nproc)" && \
    make install && \
    ldconfig && \
    useradd --system --home /var/unbound --shell /usr/sbin/nologin unbound && \
    mkdir -p /etc/unbound/python /etc/unbound/unbound.conf.d /etc/unbound/custom.conf.d /var/lib/unbound /var/unbound /run/unbound && \
    cp /usr/share/dns/root.hints /var/unbound/root.hints && \
    touch /var/unbound/root.key && \
    chown -R unbound:unbound /var/lib/unbound /var/unbound /run/unbound /etc/unbound/python && \
    cd / && \
    rm -rf /tmp/unbound.tar.gz /tmp/unbound-src /var/lib/apt/lists/*

COPY unbound.conf /etc/unbound/unbound.conf
COPY noop.py /etc/unbound/python/noop.py
COPY block_aaaa_https.py /etc/unbound/python/block_aaaa_https.py
COPY entrypoint.sh /entrypoint.sh

RUN chmod +x /entrypoint.sh && \
    chown unbound:unbound /etc/unbound/python/noop.py /etc/unbound/python/block_aaaa_https.py && \
    python3 -c "import unbound; print('pyunbound ok')" && \
    test -f /usr/local/lib/python3.13/dist-packages/unboundmodule.py && \
    unbound -V 2>&1 | tee /tmp/unbound-version.txt && \
    grep -q -- '--with-pythonmodule' /tmp/unbound-version.txt && \
    grep -q -- '--enable-cachedb' /tmp/unbound-version.txt && \
    grep -q 'Linked modules: .*python.*cachedb.*iterator' /tmp/unbound-version.txt && \
    rm /tmp/unbound-version.txt

EXPOSE 53/tcp 53/udp

HEALTHCHECK --interval=30s --timeout=10s --start-period=5s \
  CMD dig @127.0.0.1 example.com A +time=3 +tries=1 +short >/dev/null || exit 1

ENTRYPOINT ["/entrypoint.sh"]
CMD ["-d", "-c", "/etc/unbound/unbound.conf"]