# USAGE

# docker build --build-arg MAKEFLAGS=-j8 -t recursor -f docker/Dockerfile-recursor .

# docker run -p 1053:53 -p 1053:53/udp -ti --rm recursor

# dig a www.example.com @0 -p 1053

# Builder

FROM debian:10-slim AS builder

ENV NO_LUA_JIT="s390x arm64"

# Reusable layer for base update

RUN apt-get update && apt-get -y dist-upgrade && apt-get clean

# devscripts gives us mk-build-deps (and a lot of other stuff)

RUN apt-get install -y --no-install-recommends devscripts equivs git curl && apt-get clean

COPY builder-support /source/builder-support

# TODO: control file is not in tarballs at all right now

RUN mk-build-deps -i -t 'apt-get -y -o Debug::pkgProblemResolver=yes --no-install-recommends' /source/builder-support/debian/recursor/debian-buster/control && \

apt-get clean

COPY pdns /source/pdns

COPY build-aux /source/build-aux

COPY m4 /source/m4

COPY ext /source/ext

COPY .git /source/.git

COPY builder/helpers/set-configure-ac-version.sh /usr/local/bin

# build and install (TODO: before we hit this line, rearrange /source structure if we are coming from a tarball)

WORKDIR /source/pdns/recursordist

ARG MAKEFLAGS=

ENV MAKEFLAGS ${MAKEFLAGS:--j2}

ARG DOCKER_FAKE_RELEASE=NO

ENV DOCKER_FAKE_RELEASE ${DOCKER_FAKE_RELEASE}

# Manpage deps

# RUN apt-get install -y python3-venv && apt-get clean

# Manpage prevent

RUN touch pdns_recursor.1 rec_control.1 # avoid installing pandoc

RUN if [ "${DOCKER_FAKE_RELEASE}" = "YES" ]; then \

BUILDER_VERSION="$(IS_RELEASE=YES BUILDER_MODULES=recursor ./builder-support/gen-version | sed 's/\([0-9]\+\.[0-9]\+\.[0-9]\+\(\(alpha|beta|rc\)\d\+\)\)?.*/\1/')" set-configure-ac-version.sh;\

fi && \

BUILDER_MODULES=recursor autoreconf -vfi

RUN mkdir /build && \

LUAVER=$([ -z "${NO_LUA_JIT##*$(dpkg --print-architecture)*}" ] && echo 'lua5.3' || echo 'luajit') && \

./configure \

--with-lua=${LUAVER} \

LDFLAGS=-rdynamic \

--sysconfdir=/etc/powerdns \

--enable-option-checking=fatal && \

make clean && \

make $MAKEFLAGS install DESTDIR=/build && make clean && \

strip /build/usr/local/bin/* /build/usr/local/sbin/*

RUN cd /tmp && mkdir /build/tmp/ && mkdir debian && \

echo 'Source: docker-deps-for-pdns' > debian/control && \

dpkg-shlibdeps /build/usr/local/bin/rec_control /build/usr/local/sbin/pdns_recursor && \

sed 's/^shlibs:Depends=/Depends: /' debian/substvars >> debian/control && \

equivs-build debian/control && \

dpkg-deb -I equivs-dummy_1.0_all.deb && cp equivs-dummy_1.0_all.deb /build/tmp/

# Runtime

FROM debian:10-slim

# Reusable layer for base update - Should be cached from builder

RUN apt-get update && apt-get -y dist-upgrade && apt-get clean

# Ensure python3 and jinja2 is present (for startup script), and tini for signal management

RUN apt-get install -y python3 python3-jinja2 tini libcap2-bin && apt-get clean

# Executables from builder

COPY --from=builder /build /

RUN chmod 1777 /tmp # FIXME: better not use /build/tmp for equivs at all

RUN setcap 'cap_net_bind_service=+eip' /usr/local/sbin/pdns_recursor

# Ensure dependencies are present

RUN apt install -y /tmp/equivs-dummy_1.0_all.deb && apt clean

# Start script

COPY dockerdata/startup.py /usr/local/sbin/pdns_recursor-startup

# Config file(s) from builder

COPY dockerdata/recursor.conf /etc/powerdns/

# Is recursor.d necessary if we copy the config into recursor.conf? (see above)

RUN mkdir -p /etc/powerdns/recursor.d /var/run/pdns-recursor /etc/powerdns/templates.d

# Work with pdns user - not root

RUN adduser --system --disabled-password --disabled-login --no-create-home --group pdns --uid 953

RUN chown pdns:pdns /var/run/pdns-recursor /etc/powerdns/recursor.d /etc/powerdns/templates.d

USER pdns

# DNS ports

EXPOSE 53/udp

EXPOSE 53/tcp

# webserver port

EXPOSE 8082/tcp

ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/sbin/pdns_recursor-startup"]