cerealcable/kea repository overview

⁠Kea

ISC Kea⁠ DHCP server on Alpine Linux, built from source.

• Built from ISC's release tarballs, whose OpenPGP signatures are checked against ISC's code-signing keys before anything is compiled
• Separate tags for the stable, long-term support and development series
• Smoke tested before every publish
• linux/amd64 and linux/arm64
• Signed with cosign (verify⁠)

⁠Tags

ISC uses even minor versions for stable releases and odd ones for development.

Pin a series tag (3.2 or 3.0) to get patch releases without jumping to a new series. Pin a full version or a digest for reproducible deploys.

⁠Quick start

DHCP relies on broadcast traffic on your LAN, so run Kea with host networking:

docker run -d --name kea \
  --network host \
  --restart unless-stopped \
  -v ./config:/config \
  -v ./leases:/var/lib/kea \
  cerealcable/kea:3.2

⁠Docker Compose

services:
  kea:
    image: cerealcable/kea:3.2
    network_mode: host
    restart: unless-stopped
    volumes:
      - ./config:/config
      - ./leases:/var/lib/kea

⁠Configuration

/config/kea.conf is the configuration file. If it doesn't exist on first start, a placeholder copy is created that serves a documentation-only subnet (192.0.2.0/24) on eth0. Replace it with your own before putting the server on a real network.

A minimal configuration for a home LAN:

{
  "Dhcp4": {
    "interfaces-config": {
      "interfaces": [ "eth0" ],
      "dhcp-socket-type": "raw"
    },
    "lease-database": {
      "type": "memfile",
      "persist": true,
      "lfc-interval": 3600
    },
    "valid-lifetime": 86400,
    "option-data": [
      { "name": "domain-name-servers", "data": "192.168.1.1" },
      { "name": "domain-name", "data": "home.example" }
    ],
    "subnet4": [
      {
        "id": 1,
        "subnet": "192.168.1.0/24",
        "pools": [ { "pool": "192.168.1.100 - 192.168.1.199" } ],
        "option-data": [
          { "name": "routers", "data": "192.168.1.1" }
        ],
        "reservations": [
          { "hw-address": "aa:bb:cc:dd:ee:ff", "ip-address": "192.168.1.10", "hostname": "printer" }
        ]
      }
    ],
    "loggers": [
      { "name": "kea-dhcp4", "output-options": [ { "output": "stdout" } ], "severity": "INFO" }
    ]
  }
}

Set interfaces to the host's LAN interface name (ip link lists them), because with host networking that's the interface Kea binds to. Check a configuration before restarting:

docker run --rm -v ./config:/config cerealcable/kea:3.2 kea-dhcp4 -t /config/kea.conf

See the Kea Administrator Reference Manual⁠ for every option.

Without a volume on /var/lib/kea, leases are lost when the container is recreated, and Kea may hand out addresses that are still in use.

⁠Other daemons and hooks

The container runs kea-dhcp4 by default. The image also includes kea-dhcp6, kea-dhcp-ddns, kea-lfc, kea-shell and kea-admin, plus the open-source hook libraries in /usr/lib/kea/hooks. To run a different daemon, override the command:

    command: ["/usr/sbin/kea-dhcp6", "-c", "/config/kea6.conf"]

MySQL and PostgreSQL backends are not built in; leases are stored in the memfile database.

⁠Verifying the image

Images are signed with cosign. Save this public key as cerealcable.pub:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExjdgFfwLu7CHXs9+z+v7oCsWY4mo
khNFQ6ww0cKxCZR3HndkaKftoiGAgzitBQ13fL2ZPxobUv5HicDnL4idMg==
-----END PUBLIC KEY-----

Then:

cosign verify --key cerealcable.pub cerealcable/kea:3.2

⁠License

Kea is licensed under the MPL-2.0⁠. The build files for this image are MIT-licensed and derive from wastrachan/docker-kea⁠ by Winston Astrachan. This image is maintained by cerealcable and is not affiliated with ISC. Please report Kea bugs upstream⁠.