unbound-docker/CONTRIBUTING.md

Contributing

We love your input! We want to make contributing to this project as easy and transparent as possible, whether it's:

• Reporting a bug
• Discussing the current state of the code
• Submitting a fix
• Proposing new features
• Becoming a maintainer

We develop with Github

We use Github to host code, to track issues and feature requests, as well as accept pull requests.

We use Github Flow, so all code changes happen through pull requests

Pull requests are the best way to propose changes to the codebase. We actively welcome your pull requests:

1. Fork the repo and create your branch from main.
2. If you've added code that should be tested, add tests.
3. If you've changed APIs, update the documentation.
4. Ensure the test suite passes.
5. Make sure your code lints.
6. Issue that pull request!

Any contributions you make will be under the Software License

In short, when you submit code changes, your submissions are understood to be under the same Software License that covers the project. Feel free to contact the maintainers if that's a concern.

Report bugs using Github's issues

We use GitHub issues to track public bugs. Report a bug by opening a new issue; it's that easy!

Great Bug Reports tend to have:

• A quick summary and/or background
• Steps to reproduce
  • Be specific!
  • Give sample code if you can.
• What you expected would happen
• What actually happens
• Notes (possibly including why you think this might be happening, or stuff you tried that didn't work)

People love thorough bug reports. I'm not even kidding.

Use a consistent coding style

• Use hadolint for linting and validating Dockerfile changes
• Use prettier for linting and validating Markdown changes

Building

1. Enable docker buildkit and experimental mode

   export DOCKER_BUILDKIT=1
   export DOCKER_CLI_EXPERIMENTAL=enabled
   

2. Build image for host architecture

   docker build . --tag klutchell/unbound:dev
   

3. Optionally cross-build for another architecture

   docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
   docker build . --tag klutchell/unbound:dev --platform linux/arm/v6
   

[!NOTE] Outgoing port 53 must not be blocked on the network where the build is running in order to generate initial root keys with unbound-anchor!

Testing

[!NOTE] These tests resolve names recursively, so outbound DNS (UDP/TCP port 53) must be allowed on the network where they run. On firewalled networks the queries will hang or appear to fail for non-Unbound reasons; CI is the authoritative source of test results.

1. Run a detached unbound container

   docker run --rm -d --name unbound klutchell/unbound:dev
   

2. Run drill with DNSSEC to test NOERROR

   docker exec unbound drill @127.0.0.1 dnssec.works
   

3. Run drill with dnssec to test SERVFAIL

   docker exec unbound drill @127.0.0.1 fail01.dnssec.works
   docker exec unbound drill @127.0.0.1 fail02.dnssec.works
   docker exec unbound drill @127.0.0.1 fail03.dnssec.works
   docker exec unbound drill @127.0.0.1 fail04.dnssec.works
   

4. Stop and remove the test container

   docker stop unbound
   

Packaging new Unbound releases

Automated: The Bump Unbound workflow runs weekly (and on demand via Run workflow). It detects new upstream releases, updates the ARG fields below, regenerates the example config, sanity-builds the image, and opens a Bump Unbound to X.Y.Z PR for review. The manual steps below are the fallback for out-of-band bumps or when you want to drive it by hand.

1. In your working copy, create a new branch if you haven't already, and update the following fields in the Dockerfile with the new version and hash.

   ARG UNBOUND_VERSION=1.19.1
   # https://nlnetlabs.nl/downloads/unbound/unbound-1.19.1.tar.gz.sha256
   ARG UNBOUND_SHA256="a97532468854c61c2de48ca4170de854fd3bc95c8043bb0cfb0fe26605966624"
   

2. Run the following docker build command to copy the example config.

   export DOCKER_BUILDKIT=1
   export DOCKER_CLI_EXPERIMENTAL=enabled
   docker build . --target conf-example --output rootfs_overlay/etc/unbound/
   

3. Build and test changes locally.

4. Commit and push changes to Dockerfile and unbound.conf.example.

For the current pattern, see recent commits touching the Unbound ARG lines:

git log --oneline -- Dockerfile | grep -iE "bump unbound|update unbound" | head -5

Tagging a release (maintainers only)

This section applies to repository maintainers. Contributors do not need to tag releases — the maintainer will tag once your bump PR is merged.

Automated: When a bump/unbound-* PR merges, the Tag Unbound release workflow re-verifies the pinned SHA256 against the upstream tarball and creates the vX.Y.Z tag on the content commit automatically (an unsigned annotated tag), which triggers the image publish. The manual, GPG-signed procedure below remains the fallback for releases cut outside that flow.

After an Unbound bump PR is merged to main, tag the release on the content commit (the "Bump Unbound to X.Y.Z" commit), not the merge commit GitHub creates on top.

git fetch origin
# Find the content commit on origin/main
git log origin/main --grep='Bump Unbound to' --format='%H %s' -1

# Create a signed, annotated tag with the version as the message body
git tag -s vX.Y.Z -m "vX.Y.Z" <content-commit-sha>

# Push the tag
git push origin vX.Y.Z

Tags follow vMAJOR.MINOR.PATCH matching the upstream Unbound version, are annotated (not lightweight), and are GPG-signed. The tag message body is the bare version string — no release notes.

License

By contributing, you agree that your contributions will be licensed under its Software License.

References

This document was adapted from the open-source contribution guidelines for Facebook's Draft