diff --git a/Dockerfile b/Dockerfile index 74b0761..e69de29 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,21 +0,0 @@ -FROM alpine:latest -EXPOSE 53 - -RUN apk --update add bind - -RUN mkdir -m 0755 -p /var/run/named && chown -R root:named /var/run/named - -# /var/cache/bind needs to be owned by "bind" -# since we are mounting, do it manually -# NOTE: Per Dockerfile manual --> need to mkdir the mounted dir to chown -RUN mkdir -m 0755 -p /var/cache/bind && touch /var/cache/bind/docker-init && chown -R named:named /var/cache/bind - -# Mounts -# NOTE: Per Dockerfile manual --> -# "if any build steps change the data within the volume -# after it has been declared, those changes will be discarded." -VOLUME ["/etc/bind"] -VOLUME ["/var/cache/bind"] - -COPY entrypoint.sh / -ENTRYPOINT ["/entrypoint.sh"] diff --git a/README.md b/README.md index f7885d0..dfd2028 100644 --- a/README.md +++ b/README.md @@ -1,22 +1,43 @@ -NOTE: Example assumes you have a "/dns-slave01" with your container specific data! -Change as needed with the SRC data that you are mounting into the container. +### ISC BIND9 Container (Stable: 9.10.4_xx) built on top of Alpine -## Required "DATA" directory - named.conf and zone data: -This container assumes you have a "/dns" folder with your container specific data: -You can change that folder as needed, but make sure you update the "-v" mounts for run time +This container is a super small (~5MB compressed pull, and only ~9MB +when extracted) FULL version of ISC BIND9. -1.) [ *REQUIRED* ] In your /dns/etc/bind a file "named.conf", which acts as an entry point to your configs +It is ideal for a quick master, slave, recursive server/resolver, RPZ +"dns firewall", or just about any other purpose you can use bind for. -2.) [ *REQUIRED* ] A "/dns/var/cache/bind" directory for all of the master or slave zones. If it's for slave zones, it will populate automatically and you can leave it blank. +# Security - always on the latest stable release! +This container will _always_ be up to date on the latest +stable+patched version, usually within 24 hours of it being available +in Alpine. In fact, most of the BIND vulnerabilities so far have been +reported by me to the Alpine developers. -3.) [ *OPTIONAL* ] "/dns/var/log/named" directory for logging your DNS requests/returns/other breakdown. +# Required "DATA" directory - for named.conf and zone data: +This container assumes you have a "/DATA" folder with with your container specific data. +You can change that folder (and sub-folders) as needed, but make sure you update the "-v" mounts for the run. -## Run BIND Container: +Specifically, you need to have these directories/paths: ``` -docker run --name=dns-slave01 -d --dns=8.8.8.8 --dns=8.8.4.4 \ +1.) [ *REQUIRED* ] +In your "/DATA/etc/bind" directory, a file "named.conf", which acts as an entry point to your configs + +2.) [ *REQUIRED* ] +A "/DATA/var/cache/bind" directory for all of the master or slave zones. If it's for slave zones, it will populate automatically and you can leave it blank. + +3.) [ *OPTIONAL* ] +A "/DATA/var/log/named" directory for logging your DNS requests/returns/other breakdown. By default, logging is done to the console +``` + + +# How to run a BIND ("named") Docker Container? + +``` +docker run --name=dns-master01 +-it -d \ +--dns=8.8.8.8 --dns=8.8.4.4 \ -p 53:53/udp -p 53:53 \ --v /dns-slave01/etc/bind:/etc/bind \ --v /dns-slave01/var/cache/bind:/var/cache/bind \ --v /dns-slave01/var/log/named:/var/log/named \ +-v /DATA/etc/bind:/etc/bind \ +-v /DATA/var/cache/bind:/var/cache/bind \ +-v /DATA/var/log/named:/var/log/named \ ventz/bind ``` diff --git a/build.sh b/build.sh new file mode 100644 index 0000000..c27b149 --- /dev/null +++ b/build.sh @@ -0,0 +1,2 @@ +#!/bin/bash +docker build --rm=true --force-rm=true -t ventz/bind container diff --git a/container/Dockerfile b/container/Dockerfile new file mode 100644 index 0000000..8bd35a2 --- /dev/null +++ b/container/Dockerfile @@ -0,0 +1,21 @@ +FROM alpine:latest +EXPOSE 53 53/udp + +RUN apk --update add bind + +RUN mkdir -m 0755 -p /var/run/named && chown -R root:named /var/run/named + +# /var/cache/bind needs to be owned by "bind" +# since we are mounting, do it manually +# NOTE: Per Dockerfile manual --> need to mkdir the mounted dir to chown +RUN mkdir -m 0755 -p /var/cache/bind && touch /var/cache/bind/docker-init && chown -R named:named /var/cache/bind + +# Mounts +# NOTE: Per Dockerfile manual --> +# "if any build steps change the data within the volume +# after it has been declared, those changes will be discarded." +VOLUME ["/etc/bind"] +VOLUME ["/var/cache/bind"] + +COPY entrypoint.sh / +ENTRYPOINT ["/entrypoint.sh"] diff --git a/entrypoint.sh b/container/entrypoint.sh similarity index 66% rename from entrypoint.sh rename to container/entrypoint.sh index 45a591e..c044558 100755 --- a/entrypoint.sh +++ b/container/entrypoint.sh @@ -1,3 +1,4 @@ #!/bin/sh chown -R named:named /var/cache/bind +# Run in foreground and log to STDERR (console): /usr/sbin/named -c /etc/bind/named.conf -g -u named diff --git a/run.sh b/run.sh new file mode 100644 index 0000000..d264248 --- /dev/null +++ b/run.sh @@ -0,0 +1,12 @@ +#!/bin/bash +# NOTE: Please make sure you have /DATA with those directories as sources +# and the appropriate named.conf + zone files + +docker run --name=dns-master01 +-it -d \ +--dns=8.8.8.8 --dns=8.8.4.4 \ +-p 53:53/udp -p 53:53 \ +-v /DATA/etc/bind:/etc/bind \ +-v /DATA/var/cache/bind:/var/cache/bind \ +-v /DATA/var/log/named:/var/log/named \ +ventz/bind