grepular/pdns-recursor-trimmed repository overview

⁠Hardened PowerDNS Recursor

A hardened, minimal image of PowerDNS Recursor⁠. Apart from SNMP and the url option for zoneToCache, it is feature-compatible with the official image. The official image is 355 MB and 7,649 files; this one is about 37 MB and 7 files: a static musl binary on scratch, running as a non-root user with no capabilities. A launcher applies a Landlock ruleset before the resolver starts (no execute in /tmp, outbound TCP limited to ports 53 and 853), and a published seccomp profile blocks tricks like memfd_create. The source is PGP-verified against PowerDNS's release keys and the build is reproducible. Amd64 and arm64.

The two newest release trains are rebuilt daily, booted under several kernels on both architectures, and signed with cosign before publishing. For most deployments, follow a release train with X.Y. Pin X.Y.Z_<hash> for an exact image that never moves. Avoid latest, which will eventually cross a release train unattended.

• Source: https://gitlab.com/grepular/pdns-recursor-trimmed⁠
• Upstream: https://www.powerdns.com⁠
• License: GNU AGPL V3 (this repo; bundled third-party software under its own terms)
• Author: Mike Cardwell - https://www.grepular.com⁠

Hire me⁠ · Blog⁠ · RSS feed⁠

⁠Support/Appreciate my work

• Bitcoin⁠: 1PQLtWnjUi1itHLG6QCQeHM3Nxua8pRsq1
• Paypal⁠
• Buy me a Coffee⁠