cerealcable/bind repository overview

⁠BIND

ISC BIND 9⁠ DNS server on Alpine Linux, built from source.

• Built from ISC's release tarballs, whose OpenPGP signatures are checked against ISC's code-signing keys before anything is compiled
• Separate tags for the stable and extended-support series
• Smoke tested before every publish: it answers locally, recurses, serves over TCP, and keeps the capability it needs to rebind port 53
• Configurable UID/GID for named
• linux/amd64 and linux/arm64
• Signed with cosign (verify⁠)

⁠Tags

ISC's odd-numbered minor versions are development releases, and they aren't published here. Pin a series tag (9.20 or 9.18) to get patch releases without jumping to a new series. Pin a full version or a digest for reproducible deploys.

⁠Quick start

docker run -d --name bind \
  -p 53:53/udp -p 53:53/tcp \
  -v ./config:/config \
  cerealcable/bind:9.20

⁠Docker Compose

services:
  bind:
    image: cerealcable/bind:9.20
    restart: unless-stopped
    ports:
      - "53:53/udp"
      - "53:53/tcp"
    volumes:
      - ./config:/config

To bind to specific host IPs with listen-on, use network_mode: host instead of ports:.

⁠Configuration

/config/named.conf is the configuration file. If it doesn't exist on first start, the container creates:

• named.conf: a caching resolver that answers clients in 10/8, 172.16/12 and 192.168/16 and forwards to 1.1.1.1 and 8.8.8.8
• db.localhost and db.127: the localhost zones that config uses
• examples/: commented starting points for a recursive resolver (named.conf.recursive) and an authoritative server (named.conf.authoritative)

The container checks the config with named-checkconf on every start and won't start named if it fails. Reference zone files and includes by their paths under /config.

⁠Authoritative example

config/named.conf:

options {
	directory "/var/bind";
	listen-on { any; };
	listen-on-v6 { none; };
	recursion no;
	allow-recursion { none; };
	allow-transfer { none; };
	pid-file "/var/run/named/named.pid";
};

zone "example.com" IN {
	type primary;
	file "/config/db.example.com";
};

config/db.example.com:

$TTL 3600
@       IN SOA  ns1.example.com. hostmaster.example.com. (
                2026103101 ; serial
                3600       ; refresh
                900        ; retry
                1209600    ; expire
                300 )      ; negative caching TTL
        IN NS   ns1.example.com.
ns1     IN A    192.0.2.53
@       IN A    192.0.2.10
www     IN CNAME @

Check a zone before loading it:

docker exec bind named-checkzone example.com /config/db.example.com

Then restart the container, or set up rndc to reload without a restart. The image ships no rndc key, so generate one into /config:

docker run --rm -v ./config:/config --entrypoint rndc-confgen \
  cerealcable/bind:9.20 -a -c /config/rndc.key

Add this to named.conf and restart once:

include "/config/rndc.key";
controls {
	inet 127.0.0.1 port 953 allow { localhost; } keys { "rndc-key"; };
};

From then on:

docker exec bind rndc -k /config/rndc.key reload

Keep a server either authoritative or recursive, not both. If you run a resolver, never allow recursion from any: an open resolver gets abused for reflection attacks.

⁠Tools

The image also includes dig, host, delv, nsupdate, rndc, named-checkconf, named-checkzone and tsig-keygen, so you can run them with docker exec.

⁠User / group

On every start the container sets the ownership of everything in /config to PUID:PGID, so mount a directory that only holds BIND's files.

⁠Verifying the image

Images are signed with cosign. Save this public key as cerealcable.pub:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExjdgFfwLu7CHXs9+z+v7oCsWY4mo
khNFQ6ww0cKxCZR3HndkaKftoiGAgzitBQ13fL2ZPxobUv5HicDnL4idMg==
-----END PUBLIC KEY-----

Then:

cosign verify --key cerealcable.pub cerealcable/bind:9.20

⁠License

BIND is licensed under the MPL-2.0⁠. The build files for this image are MIT-licensed and derive from wastrachan/docker-bind⁠ by Winston Astrachan. This image is maintained by cerealcable and is not affiliated with ISC. Please report BIND bugs upstream⁠.