70 lines
2.2 KiB
Docker
70 lines
2.2 KiB
Docker
# Build stage.
|
|
#
|
|
# CGO stays off: the SQLite driver is pure Go, so the result is a static binary
|
|
# that runs on any base image, including scratch.
|
|
FROM golang:1.26-alpine AS build
|
|
|
|
WORKDIR /src
|
|
|
|
# Dependencies first, so a source-only change reuses this layer.
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
ARG VERSION=dev
|
|
ARG COMMIT=unknown
|
|
ARG BUILD_DATE=unknown
|
|
|
|
RUN CGO_ENABLED=0 GOOS=linux go build \
|
|
-trimpath \
|
|
-ldflags="-s -w \
|
|
-X github.com/owen/vibedns/internal/version.Version=${VERSION} \
|
|
-X github.com/owen/vibedns/internal/version.Commit=${COMMIT} \
|
|
-X github.com/owen/vibedns/internal/version.BuildDate=${BUILD_DATE}" \
|
|
-o /out/vibedns ./cmd/vibedns
|
|
|
|
# Verify the templates and assets really are embedded, so a broken build fails
|
|
# here rather than at the first page load in production.
|
|
RUN CGO_ENABLED=0 go test ./internal/web/ -run TestStaticAssetsEmbedded -count=1
|
|
|
|
|
|
# Runtime stage.
|
|
FROM alpine:3.20
|
|
|
|
# ca-certificates is not needed for DNS itself, but keeps outbound HTTPS working
|
|
# if an operator ever fetches a blocklist from the host. tzdata makes log
|
|
# timestamps and retention windows follow the configured timezone.
|
|
RUN apk add --no-cache ca-certificates tzdata \
|
|
&& addgroup -g 10001 -S vibedns \
|
|
&& adduser -u 10001 -S -G vibedns -h /var/lib/vibedns vibedns \
|
|
&& mkdir -p /var/lib/vibedns \
|
|
&& chown -R vibedns:vibedns /var/lib/vibedns
|
|
|
|
COPY --from=build /out/vibedns /usr/local/bin/vibedns
|
|
|
|
# Allow binding port 53 as an unprivileged user. Without this the container
|
|
# would have to run as root just to open the DNS socket.
|
|
RUN apk add --no-cache libcap \
|
|
&& setcap 'cap_net_bind_service=+ep' /usr/local/bin/vibedns \
|
|
&& apk del libcap
|
|
|
|
USER vibedns
|
|
WORKDIR /var/lib/vibedns
|
|
|
|
VOLUME ["/var/lib/vibedns"]
|
|
|
|
EXPOSE 53/udp 53/tcp 8080/tcp
|
|
|
|
ENV VIBEDNS_DB_PATH=/var/lib/vibedns/dns.db \
|
|
VIBEDNS_HTTP_ADDR=0.0.0.0:8080 \
|
|
VIBEDNS_DNS_ADDR=0.0.0.0:53
|
|
|
|
# /healthz never touches the database, so a database problem does not cause the
|
|
# orchestrator to kill a process that is still answering from cache and zones.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD wget -qO- http://127.0.0.1:8080/healthz >/dev/null || exit 1
|
|
|
|
ENTRYPOINT ["/usr/local/bin/vibedns"]
|
|
CMD ["serve"]
|