mirror of
https://github.com/klutchell/unbound-docker.git
synced 2026-10-13 16:02:41 +00:00
69 lines
3.2 KiB
YAML
69 lines
3.2 KiB
YAML
services:
|
|
server:
|
|
image: localhost:5000/sut
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
volumes:
|
|
# enable send-client-subnet example configuration file
|
|
- ./rootfs_overlay/etc/unbound/custom.conf.d/send-client-subnet.conf.example:/etc/unbound/custom.conf.d/send-client-subnet.conf:ro
|
|
# enable custom-port example configuration file
|
|
- ./rootfs_overlay/etc/unbound/custom.conf.d/custom-port.conf.example:/etc/unbound/custom.conf.d/custom-port.conf:ro
|
|
# enable remote-control example configuration file
|
|
- ./rootfs_overlay/etc/unbound/custom.conf.d/remote-control.conf.example:/etc/unbound/custom.conf.d/remote-control.conf:ro
|
|
command: -v -v
|
|
|
|
sut:
|
|
image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
|
|
depends_on:
|
|
- server
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
working_dir: /test
|
|
entrypoint:
|
|
- /bin/sh
|
|
- -c
|
|
command:
|
|
- |
|
|
set -ex
|
|
apk add --no-cache bind-tools docker-cli
|
|
|
|
server_ip="$$(dig +short server | tail -n 1)"
|
|
while read id
|
|
do
|
|
if docker inspect --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' $${id} | grep -q "$${server_ip}"
|
|
then
|
|
server_id="$${id}"
|
|
break
|
|
fi
|
|
done < <(docker ps --format '{{.ID}}')
|
|
|
|
docker exec $${server_id} unbound -V
|
|
docker exec $${server_id} unbound-checkconf
|
|
docker exec $${server_id} unbound-anchor -v
|
|
docker exec $${server_id} drill -v
|
|
|
|
sleep 5
|
|
|
|
docker exec $${server_id} drill-hc -p 5353 dnssec.works @127.0.0.1 | tee /dev/stderr | grep NOERROR
|
|
! docker exec $${server_id} drill-hc -p 5353 foo.local @127.0.0.1 | tee /dev/stderr | grep NOERROR
|
|
! docker exec $${server_id} drill-hc -p 5353 bar.local @127.0.0.1 | tee /dev/stderr | grep NOERROR
|
|
|
|
dig @server -p 5353 dnssec.works +dnssec +multi | tee /dev/stderr | grep NOERROR
|
|
! dig @server -p 5353 fail01.dnssec.works +dnssec +multi | tee /dev/stderr | grep NOERROR
|
|
! dig @server -p 5353 fail02.dnssec.works +dnssec +multi | tee /dev/stderr | grep NOERROR
|
|
! dig @server -p 5353 fail03.dnssec.works +dnssec +multi | tee /dev/stderr | grep NOERROR
|
|
! dig @server -p 5353 fail04.dnssec.works +dnssec +multi | tee /dev/stderr | grep NOERROR
|
|
|
|
# Check the subnet module is built in and the send-client-subnet example
|
|
# config is active. A real ECS round-trip is deliberately not asserted
|
|
# here: authorities refuse non-routable prefixes, and whether they echo
|
|
# the option back varies between anycast instances. When they do not
|
|
# echo it, unbound re-resolves without the subnet and the answer reaches
|
|
# the client with no CLIENT-SUBNET option, so every client-visible ECS
|
|
# assertion is a coin flip. Testing the round-trip needs an
|
|
# authoritative server we control.
|
|
docker exec $${server_id} unbound -V | grep 'Linked modules:.*subnetcache'
|
|
docker logs $${server_id} 2>&1 | grep 'init module 0: subnetcache'
|
|
docker logs $${server_id} 2>&1 | grep 'send-client-subnet: 0\.0\.0\.0/0'
|