mirror of
https://github.com/hanzoai/dns.git
synced 2026-10-30 18:40:55 +00:00
zeekay
cd3670663c
coredns Dockerfile: drop the ARG BASE=gcr.io/distroless/* indirection and the gcr.io fallback. The runtime is now FROM scratch with CA certs, tzdata, /etc/passwd and /etc/group (nonroot uid/gid 65532) copied from the debian build stage. The cap_net_bind_service file capability set via setcap on /coredns survives the COPY between layers, so binding to port 53 as the nonroot user still works. operator Dockerfile: same scratch swap, no setcap needed.
26 lines
1.0 KiB
Docker
26 lines
1.0 KiB
Docker
ARG DEBIAN_IMAGE=debian:stable-slim
|
|
|
|
FROM --platform=$BUILDPLATFORM ${DEBIAN_IMAGE} AS build
|
|
ARG DEBIAN_FRONTEND=noninteractive
|
|
RUN apt-get -qq update \
|
|
&& apt-get -qq --no-install-recommends install libcap2-bin ca-certificates tzdata \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
# Create nonroot user/group records (uid/gid 65532) for the scratch runtime.
|
|
RUN groupadd -g 65532 -r nonroot && useradd -u 65532 -r -g nonroot nonroot
|
|
COPY coredns /coredns
|
|
RUN setcap cap_net_bind_service=+ep /coredns
|
|
|
|
# Scratch runtime — coredns is a static Go binary; bind capability on
|
|
# port 53 is set on the binary itself via setcap in the build stage and
|
|
# preserved by COPY (the file capability xattr survives the layer copy).
|
|
FROM scratch
|
|
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
COPY --from=build /usr/share/zoneinfo /usr/share/zoneinfo
|
|
COPY --from=build /etc/passwd /etc/passwd
|
|
COPY --from=build /etc/group /etc/group
|
|
COPY --from=build /coredns /coredns
|
|
USER 65532:65532
|
|
WORKDIR /
|
|
EXPOSE 53 53/udp
|
|
ENTRYPOINT ["/coredns"]
|