feat: setup unbound with default config

.dockerignore

@@ -1,3 +1,4 @@
 .github
 .husky
+docs
 node_modules

Dockerfile

@@ -1,26 +1,49 @@
-# builder image
-FROM --platform=${BUILDPLATFORM} alpine AS builder
+# tini
+FROM --platform=${BUILDPLATFORM} alpine:3.16 as tini
 LABEL maintainer="info@pascaliske.dev"
 
-# arguments
-ARG TARGETOS
-ARG TARGETARCH
+# environment
+ENV TINI_VERSION=v0.19.0
+ARG TARGETPLATFORM
 
-# build
-# RUN OS=${TARGETOS} ARCH=${TARGETARCH} build
+# install tini
+RUN case ${TARGETPLATFORM} in \
+    "linux/amd64")  TINI_ARCH=amd64  ;; \
+    "linux/arm64")  TINI_ARCH=arm64  ;; \
+    "linux/arm/v7") TINI_ARCH=armhf  ;; \
+    esac \
+    && wget -q https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini-static-${TINI_ARCH} -O /tini \
+    && chmod +x /tini
 
 # final image
-FROM alpine:latest
+FROM alpine:3.16
 LABEL maintainer="info@pascaliske.dev"
 
-# environment
-# ENV key=value
+# install unbound
+RUN apk update && apk upgrade && apk add --no-cache \
+    bind-tools \
+    openssl \
+    unbound
+
+# inject built files
+COPY --from=tini /tini /sbin/tini
+
+# inkect config files
+COPY config/unbound.conf /etc/unbound/unbound.conf
+
+# inject entrypoint
+COPY docker-entrypoint.sh /docker-entrypoint.sh
+
+# increase maximum receive window size
+RUN echo "net.core.rmem_max=1048576" >> /etc/sysctl.conf
 
-# volumes
-# VOLUME [  ]
+# health check
+HEALTHCHECK CMD dig @127.0.0.1 -p 5053 cloudflare.com || exit 1
 
-# copy built files
-# COPY --from=builder /from/builder/image /to/final/image
+# expose port
+EXPOSE 5053/tcp
+EXPOSE 5053/udp
 
-# setup entrypoint
-# ENTRYPOINT [  ]
+# let's go!
+ENTRYPOINT [ "/sbin/tini", "--", "/docker-entrypoint.sh" ]
+CMD [ "/usr/sbin/unbound", "-v", "-d" ]

README.md

@@ -1,6 +1,6 @@
 # `pascaliske/docker-unbound`
 
-> TBD
+> Small Alpine based image for unbound - the validating and caching recursive DNS resolver.
 
 [![Docker Image Version (tag latest semver)](https://img.shields.io/docker/v/pascaliske/unbound/latest?style=flat-square)](https://hub.docker.com/r/pascaliske/unbound) [![Docker Image Size (tag)](https://img.shields.io/docker/image-size/pascaliske/unbound/latest?style=flat-square)](https://hub.docker.com/r/pascaliske/unbound) [![Docker Pulls](https://img.shields.io/docker/pulls/pascaliske/unbound?style=flat-square)](https://hub.docker.com/r/pascaliske/unbound) [![GitHub Tag](https://img.shields.io/github/v/tag/pascaliske/docker-unbound?style=flat-square)](https://github.com/pascaliske/docker-unbound) [![Build Status](https://img.shields.io/github/workflow/status/pascaliske/docker-unbound/Image/master?label=build&style=flat-square)](https://github.com/pascaliske/docker-unbound/actions) [![GitHub Last Commit](https://img.shields.io/github/last-commit/pascaliske/docker-unbound?style=flat-square)](https://github.com/pascaliske/docker-unbound) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg?style=flat-square)](https://opensource.org/licenses/MIT) [![Awesome Badges](https://img.shields.io/badge/badges-awesome-green.svg?style=flat-square)](https://github.com/Naereen/badges)
 

config/unbound.conf

@@ -0,0 +1,47 @@
+server:
+    # general
+    do-daemonize: no
+
+    # logging
+    use-syslog: no
+    verbosity: 0
+
+    # network
+    interface: 0.0.0.0
+    port: 5053
+
+    # response
+    do-ip4: yes
+    do-udp: yes
+    do-tcp: yes
+    minimal-responses: yes
+
+    # trust glue only if it is within the server's authority
+    harden-glue: yes
+
+    # require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
+    harden-dnssec-stripped: yes
+
+    # don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
+    # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
+    use-caps-for-id: no
+
+    # reduce EDNS reassembly buffer size
+    edns-buffer-size: 1232
+
+    # perform prefetching of close to expired message cache entries
+    prefetch: yes
+
+    # ensure privacy of local IP ranges
+    private-address: 192.168.0.0/16
+    private-address: 169.254.0.0/16
+    private-address: 172.16.0.0/12
+    private-address: 10.0.0.0/8
+    private-address: fd00::/8
+    private-address: fe80::/10
+
+    # only give access to recursion clients from LAN IPs
+    access-control: 127.0.0.1/32 allow
+    access-control: 192.168.0.0/16 allow
+    access-control: 172.16.0.0/12 allow
+    access-control: 10.0.0.0/8 allow

docker-entrypoint.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+# -*- coding: utf-8 -*-
+
+# exec container command
+exec "$@"