mirror of
https://github.com/klutchell/unbound-docker.git
synced 2026-10-26 08:02:18 +00:00
Merge pull request #514 from klutchell/kyle/unbound-1.22.0
Update Unbound to release 1.22.0
This commit is contained in:
Kyle Harding
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"printWidth": 80,
|
||||
"tabWidth": 2,
|
||||
"useTabs": false,
|
||||
"semi": false,
|
||||
"singleQuote": true,
|
||||
"quoteProps": "as-needed",
|
||||
"jsxSingleQuote": false,
|
||||
"trailingComma": "none",
|
||||
"bracketSpacing": true,
|
||||
"bracketSameLine": true,
|
||||
"arrowParens": "avoid",
|
||||
"proseWrap": "always",
|
||||
"htmlWhitespaceSensitivity": "css",
|
||||
"endOfLine": "lf"
|
||||
}
|
||||
+65
-51
@@ -1,6 +1,7 @@
|
||||
# Contributing
|
||||
|
||||
We love your input! We want to make contributing to this project as easy and transparent as possible, whether it's:
|
||||
We love your input! We want to make contributing to this project as easy and
|
||||
transparent as possible, whether it's:
|
||||
|
||||
- Reporting a bug
|
||||
- Discussing the current state of the code
|
||||
@@ -10,11 +11,13 @@ We love your input! We want to make contributing to this project as easy and tra
|
||||
|
||||
## We develop with Github
|
||||
|
||||
We use Github to host code, to track issues and feature requests, as well as accept pull requests.
|
||||
We use Github to host code, to track issues and feature requests, as well as
|
||||
accept pull requests.
|
||||
|
||||
## We use [Github Flow](https://guides.github.com/introduction/flow/index.html), so all code changes happen through pull requests
|
||||
|
||||
Pull requests are the best way to propose changes to the codebase. We actively welcome your pull requests:
|
||||
Pull requests are the best way to propose changes to the codebase. We actively
|
||||
welcome your pull requests:
|
||||
|
||||
1. Fork the repo and create your branch from `main`.
|
||||
2. If you've added code that should be tested, add tests.
|
||||
@@ -25,11 +28,15 @@ Pull requests are the best way to propose changes to the codebase. We actively w
|
||||
|
||||
## Any contributions you make will be under the [Software License](LICENSE.md)
|
||||
|
||||
In short, when you submit code changes, your submissions are understood to be under the same [Software License](LICENSE.md) that covers the project. Feel free to contact the maintainers if that's a concern.
|
||||
In short, when you submit code changes, your submissions are understood to be
|
||||
under the same [Software License](LICENSE.md) that covers the project. Feel free
|
||||
to contact the maintainers if that's a concern.
|
||||
|
||||
## Report bugs using Github's [issues](https://github.com/klutchell/unbound-docker/issues)
|
||||
|
||||
We use GitHub issues to track public bugs. Report a bug by [opening a new issue](https://github.com/klutchell/unbound-docker/issues/new); it's that easy!
|
||||
We use GitHub issues to track public bugs. Report a bug by
|
||||
[opening a new issue](https://github.com/klutchell/unbound-docker/issues/new);
|
||||
it's that easy!
|
||||
|
||||
**Great Bug Reports** tend to have:
|
||||
|
||||
@@ -39,98 +46,105 @@ We use GitHub issues to track public bugs. Report a bug by [opening a new issue]
|
||||
- Give sample code if you can.
|
||||
- What you expected would happen
|
||||
- What actually happens
|
||||
- Notes (possibly including why you think this might be happening, or stuff you tried that didn't work)
|
||||
- Notes (possibly including why you think this might be happening, or stuff you
|
||||
tried that didn't work)
|
||||
|
||||
People _love_ thorough bug reports. I'm not even kidding.
|
||||
|
||||
## Use a consistent coding style
|
||||
|
||||
- Use [hadolint](https://github.com/hadolint/hadolint) for linting and validating Dockerfile changes
|
||||
- Use [prettier](https://prettier.io) for linting and validating Markdown changes
|
||||
- Use [hadolint](https://github.com/hadolint/hadolint) for linting and
|
||||
validating Dockerfile changes
|
||||
- Use [prettier](https://prettier.io) for linting and validating Markdown
|
||||
changes
|
||||
|
||||
## Building
|
||||
|
||||
1. Enable docker buildkit and experimental mode
|
||||
|
||||
```bash
|
||||
export DOCKER_BUILDKIT=1
|
||||
export DOCKER_CLI_EXPERIMENTAL=enabled
|
||||
```
|
||||
```bash
|
||||
export DOCKER_BUILDKIT=1
|
||||
export DOCKER_CLI_EXPERIMENTAL=enabled
|
||||
```
|
||||
|
||||
2. Build image for host architecture
|
||||
|
||||
```bash
|
||||
docker build . --tag klutchell/unbound:dev
|
||||
```
|
||||
```bash
|
||||
docker build . --tag klutchell/unbound:dev
|
||||
```
|
||||
|
||||
3. Optionally cross-build for another architecture
|
||||
|
||||
```bash
|
||||
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
|
||||
docker build . --tag klutchell/unbound:dev --platform linux/arm/v6
|
||||
```
|
||||
```bash
|
||||
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
|
||||
docker build . --tag klutchell/unbound:dev --platform linux/arm/v6
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> Outgoing port 53 must not be blocked on the network where the build is running
|
||||
> in order to generate initial root keys with unbound-anchor!
|
||||
> [!NOTE] Outgoing port 53 must not be blocked on the network where the build is
|
||||
> running in order to generate initial root keys with unbound-anchor!
|
||||
|
||||
## Testing
|
||||
|
||||
1. Run a detached unbound container
|
||||
|
||||
```bash
|
||||
docker run --rm -d --name unbound klutchell/unbound:dev
|
||||
```
|
||||
```bash
|
||||
docker run --rm -d --name unbound klutchell/unbound:dev
|
||||
```
|
||||
|
||||
2. Run drill with DNSSEC to test NOERROR
|
||||
|
||||
```bash
|
||||
docker exec unbound drill @127.0.0.1 dnssec.works
|
||||
```
|
||||
```bash
|
||||
docker exec unbound drill @127.0.0.1 dnssec.works
|
||||
```
|
||||
|
||||
3. Run drill with dnssec to test SERVFAIL
|
||||
|
||||
```bash
|
||||
docker exec unbound drill @127.0.0.1 fail01.dnssec.works
|
||||
docker exec unbound drill @127.0.0.1 fail02.dnssec.works
|
||||
docker exec unbound drill @127.0.0.1 fail03.dnssec.works
|
||||
docker exec unbound drill @127.0.0.1 fail04.dnssec.works
|
||||
```
|
||||
```bash
|
||||
docker exec unbound drill @127.0.0.1 fail01.dnssec.works
|
||||
docker exec unbound drill @127.0.0.1 fail02.dnssec.works
|
||||
docker exec unbound drill @127.0.0.1 fail03.dnssec.works
|
||||
docker exec unbound drill @127.0.0.1 fail04.dnssec.works
|
||||
```
|
||||
|
||||
4. Stop and remove the test container
|
||||
|
||||
```bash
|
||||
docker stop unbound
|
||||
```
|
||||
```bash
|
||||
docker stop unbound
|
||||
```
|
||||
|
||||
## Packaging new Unbound releases
|
||||
|
||||
1. In your working copy, create a new branch if you haven't already, and update the following fields in the [Dockerfile](Dockerfile) with the new version and hash.
|
||||
1. In your working copy, create a new branch if you haven't already, and update
|
||||
the following fields in the [Dockerfile](Dockerfile) with the new version and
|
||||
hash.
|
||||
|
||||
```dockerfile
|
||||
ARG UNBOUND_VERSION=1.19.1
|
||||
# https://nlnetlabs.nl/downloads/unbound/unbound-1.19.1.tar.gz.sha256
|
||||
ARG UNBOUND_SHA256="a97532468854c61c2de48ca4170de854fd3bc95c8043bb0cfb0fe26605966624"
|
||||
```
|
||||
```dockerfile
|
||||
ARG UNBOUND_VERSION=1.19.1
|
||||
# https://nlnetlabs.nl/downloads/unbound/unbound-1.19.1.tar.gz.sha256
|
||||
ARG UNBOUND_SHA256="a97532468854c61c2de48ca4170de854fd3bc95c8043bb0cfb0fe26605966624"
|
||||
```
|
||||
|
||||
2. Run the following docker build command to copy the example config.
|
||||
|
||||
```bash
|
||||
export DOCKER_BUILDKIT=1
|
||||
export DOCKER_CLI_EXPERIMENTAL=enabled
|
||||
docker build . --target conf-example --output rootfs_overlay/etc/unbound/
|
||||
```
|
||||
```bash
|
||||
export DOCKER_BUILDKIT=1
|
||||
export DOCKER_CLI_EXPERIMENTAL=enabled
|
||||
docker build . --target conf-example --output rootfs_overlay/etc/unbound/
|
||||
```
|
||||
|
||||
3. [Build](#building) and [test](#testing) changes locally.
|
||||
|
||||
4. Commit and push changes to `Dockerfile` and `unbound.conf.example`.
|
||||
|
||||
[Here](https://github.com/klutchell/unbound-docker/pull/235) is an example pull request for reference.
|
||||
[Here](https://github.com/klutchell/unbound-docker/pull/235) is an example pull
|
||||
request for reference.
|
||||
|
||||
## License
|
||||
|
||||
By contributing, you agree that your contributions will be licensed under its [Software License](LICENSE.md).
|
||||
By contributing, you agree that your contributions will be licensed under its
|
||||
[Software License](LICENSE.md).
|
||||
|
||||
## References
|
||||
|
||||
This document was adapted from the open-source contribution guidelines for [Facebook's Draft](https://github.com/facebook/draft-js)
|
||||
This document was adapted from the open-source contribution guidelines for
|
||||
[Facebook's Draft](https://github.com/facebook/draft-js)
|
||||
|
||||
+3
-3
@@ -62,9 +62,9 @@ FROM build-base AS unbound
|
||||
|
||||
WORKDIR /src
|
||||
|
||||
ARG UNBOUND_VERSION=1.21.1
|
||||
# https://nlnetlabs.nl/downloads/unbound/unbound-1.21.1.tar.gz.sha256
|
||||
ARG UNBOUND_SHA256="3036d23c23622b36d3c87e943117bdec1ac8f819636eb978d806416b0fa9ea46"
|
||||
ARG UNBOUND_VERSION=1.22.0
|
||||
# https://nlnetlabs.nl/downloads/unbound/unbound-1.22.0.tar.gz.sha256
|
||||
ARG UNBOUND_SHA256="c5dd1bdef5d5685b2cedb749158dd152c52d44f65529a34ac15cd88d4b1b3d43"
|
||||
|
||||
ADD https://nlnetlabs.nl/downloads/unbound/unbound-${UNBOUND_VERSION}.tar.gz unbound.tar.gz
|
||||
|
||||
|
||||
@@ -3,11 +3,15 @@
|
||||
[](https://hub.docker.com/r/klutchell/unbound)
|
||||
[](https://hub.docker.com/r/klutchell/unbound)
|
||||
|
||||
[Unbound](https://unbound.net/) is a validating, recursive, and caching DNS resolver.
|
||||
[Unbound](https://unbound.net/) is a validating, recursive, and caching DNS
|
||||
resolver.
|
||||
|
||||
Note that this image is [distroless](https://github.com/GoogleContainerTools/distroless)!
|
||||
Note that this image is
|
||||
[distroless](https://github.com/GoogleContainerTools/distroless)!
|
||||
|
||||
> "Distroless" images contain only your application and its runtime dependencies. They do not contain package managers, shells or any other programs you would expect to find in a standard Linux distribution.
|
||||
> "Distroless" images contain only your application and its runtime
|
||||
> dependencies. They do not contain package managers, shells or any other
|
||||
> programs you would expect to find in a standard Linux distribution.
|
||||
|
||||
## Usage/Examples
|
||||
|
||||
@@ -19,8 +23,9 @@ docker run --name unbound \
|
||||
klutchell/unbound
|
||||
```
|
||||
|
||||
Optionally mount [custom configuration](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html) from a host directory.
|
||||
Files must be readable by user/group `101:102` or world.
|
||||
Optionally mount
|
||||
[custom configuration](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html)
|
||||
from a host directory. Files must be readable by user/group `101:102` or world.
|
||||
|
||||
```bash
|
||||
docker run --name unbound \
|
||||
@@ -31,11 +36,17 @@ docker run --name unbound \
|
||||
|
||||
### Optional: Enable CacheDB Module with Redis backend
|
||||
|
||||
The cache DB module was compiled into daemon, but is disabled by default. To enable this module, follow this steps:
|
||||
* Modify [unbound.conf](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#cache-db-module-options) to add the following directive:
|
||||
> module-config: "validator cachedb iterator"
|
||||
The cache DB module was compiled into daemon, but is disabled by default. To
|
||||
enable this module, follow this steps:
|
||||
|
||||
* Create a `cachedb.conf` under your custom configuration directory `/path/to/config/custom.conf.d` with Redis credentials:
|
||||
- Modify
|
||||
[unbound.conf](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#cache-db-module-options)
|
||||
to add the following directive:
|
||||
|
||||
> module-config: "validator cachedb iterator"
|
||||
|
||||
- Create a `cachedb.conf` under your custom configuration directory
|
||||
`/path/to/config/custom.conf.d` with Redis credentials:
|
||||
|
||||
```bash
|
||||
cachedb:
|
||||
@@ -44,6 +55,7 @@ cachedb:
|
||||
redis-server-port: 6379
|
||||
redis-expire-records: yes
|
||||
```
|
||||
|
||||
Files must be readable by user/group `101:102` or world.
|
||||
|
||||
Examples of docker-compose usage can be found in [examples](examples).
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#
|
||||
# Example configuration file.
|
||||
#
|
||||
# See unbound.conf(5) man page, version 1.21.1.
|
||||
# See unbound.conf(5) man page, version 1.22.0.
|
||||
#
|
||||
# this is a comment.
|
||||
|
||||
@@ -187,6 +187,15 @@ server:
|
||||
# query upon encountering a CNAME record.
|
||||
# max-query-restarts: 11
|
||||
|
||||
# Limit on number of NS records in NS RRset for incoming packets.
|
||||
# iter-scrub-ns: 20
|
||||
|
||||
# Limit on number of CNAME, DNAME records for incoming packets.
|
||||
# iter-scrub-cname: 11
|
||||
|
||||
# Limit on upstream queries for an incoming query and its recursion.
|
||||
# max-global-quota: 128
|
||||
|
||||
# msec for waiting for an unknown server to reply. Increase if you
|
||||
# are behind a slow satellite link, to eg. 1128.
|
||||
# unknown-server-time-limit: 376
|
||||
@@ -452,6 +461,10 @@ server:
|
||||
# print UTC timestamp in ascii to logfile, default is epoch in seconds.
|
||||
# log-time-ascii: no
|
||||
|
||||
# log timestamp in ISO8601 format if also log-time-ascii is enabled.
|
||||
# (y-m-dTh:m:s.msec[+-]tzhours:tzminutes)
|
||||
# log-time-iso: no
|
||||
|
||||
# print one line with time, IP, name, type, class for every query.
|
||||
# log-queries: no
|
||||
|
||||
@@ -524,6 +537,9 @@ server:
|
||||
# Harden against out of zone rrsets, to avoid spoofing attempts.
|
||||
# harden-glue: yes
|
||||
|
||||
# Harden against unverified (outside-zone, including sibling zone) glue rrsets
|
||||
# harden-unverified-glue: no
|
||||
|
||||
# Harden against receiving dnssec-stripped data. If you turn it
|
||||
# off, failing to validate dnskey data for a trustanchor will
|
||||
# trigger insecure mode for that zone (like without a trustanchor).
|
||||
@@ -904,6 +920,7 @@ server:
|
||||
# tls-service-pem: "path/to/publiccertfile.pem"
|
||||
# tls-port: 853
|
||||
# https-port: 443
|
||||
# quic-port: 853
|
||||
|
||||
# cipher setting for TLSv1.2
|
||||
# tls-ciphers: "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256"
|
||||
@@ -968,6 +985,9 @@ server:
|
||||
# Disable TLS for DNS-over-HTTP downstream service.
|
||||
# http-notls-downstream: no
|
||||
|
||||
# Maximum number of bytes used for QUIC buffers.
|
||||
# quic-size: 8m
|
||||
|
||||
# The interfaces that use these listed port numbers will support and
|
||||
# expect PROXYv2. For UDP and TCP/TLS interfaces.
|
||||
# proxy-protocol-port: portno for each of the port numbers.
|
||||
@@ -1289,6 +1309,10 @@ remote-control:
|
||||
# # redis-server-password: ""
|
||||
# # timeout (in ms) for communication with the redis server
|
||||
# redis-timeout: 100
|
||||
# # timeout (in ms) for commands, if 0, uses redis-timeout.
|
||||
# redis-command-timeout: 0
|
||||
# # timeout (in ms) for connection set up, if 0, uses redis-timeout.
|
||||
# redis-connect-timeout: 0
|
||||
# # set timeout on redis records based on DNS response TTL
|
||||
# redis-expire-records: no
|
||||
# # redis logical database to use, 0 is the default database.
|
||||
|
||||
Reference in New Issue
Block a user