trigus42/unbound repository overview

FROM alpine:

RUN apk -U upgrade; \
    apk add --update --no-cache bash ca-certificates wget unbound

RUN chown -R unbound:unbound /usr/share/dnssec-root/; \
    chmod -R 744 /usr/share/dnssec-root/; \
    chown -R unbound:unbound /etc/unbound/; \
    chmod -R 744 /etc/unbound/; \
    wget https://www.internic.net/domain/named.root -O /etc/unbound/root.hints

EXPOSE 53/udp 53/tcp

ADD unbound.conf /etc/unbound/

ADD entrypoint.sh /
RUN chmod +x entrypoint.sh
ENTRYPOINT ["/bin/sh","-c","/entrypoint.sh"]

#!/bin/bash
/usr/sbin/unbound -d -c /etc/unbound/unbound.conf

# For further information read: https://nlnetlabs.nl/documentation/unbound/unbound.conf/

server:
	# Listen on all interfaces
    interface: 0.0.0.0
	interface: ::0
	
	# The port number, default 53, on which the server responds to queries. 
	port: 53

	# If given, after binding the port the user privileges are dropped.
	# Default is "unbound". If you give username: "" no user change is performed. 
	username: "unbound"

	# The netblock is given as an IP4 or IP6 address with /size appended for a
	# classless network block. The action can be deny, refuse, allow or allow_snoop.
	# Here 0.0.0.0/0 is used cause we run it in a container and access to it should
	# controlled by the host.
	access-control: 0.0.0.0/0 allow

	# If "" is given, logging goes to stderr, or nowhere once daemonized.
	logfile: ""

	# The verbosity number, level 0 means no verbosity, only errors.
	# Level 1 gives operational information.
	# Level 2 gives detailed operational information.
	# Level 3 gives query level information, output per query. 
	# Level 4 gives algorithm level information.
	# Level 5 logs client identification for cache misses.
	# Default is level 1. The verbosity can also be increased from the commandline.
	verbosity: 2

	# Read  the  root  hints from this file. Default is nothing, using
	# builtin hints for the IN class. The file has the format of  zone
	# files,  with  root  nameserver  names  and  addresses  only. The
	# default may become outdated, when servers change,  therefore  it
	# is good practice to use a root-hints file.
	root-hints: /etc/unbound/root.hints

	# File with trust anchor for one zone, which is tracked with RFC5011 probes.
	# The probes are several times per month, thus the machine must be online frequently.
	# The initial file can be one with contents as described in trust-anchor-file.
	# The file is written to when the anchor is updated, so the unbound user must
	# have write permission.
	auto-trust-anchor-file: /usr/share/dnssec-root/trusted-key.key