Dockerfile-recursor

# USAGE

#   docker build --build-arg MAKEFLAGS=-j8 -t recursor -f Dockerfile-recursor .
#   docker run -p 1053:53 -p 1053:53/udp -ti --rm recursor
#   dig a www.example.com @0 -p 1053

# Builder
FROM debian:11-slim AS builder

ENV NO_LUA_JIT="s390x arm64"

# Reusable layer for base update
RUN apt-get update && apt-get -y dist-upgrade && apt-get clean

# devscripts gives us mk-build-deps (and a lot of other stuff)
RUN apt-get install -y --no-install-recommends devscripts equivs git curl jq && apt-get clean

COPY builder-support /source/builder-support

# TODO: control file is not in tarballs at all right now
RUN mk-build-deps -i -t 'apt-get -y -o Debug::pkgProblemResolver=yes --no-install-recommends' /source/builder-support/debian/recursor/debian-buster/control && \
    apt-get clean

COPY pdns /source/pdns
COPY build-aux /source/build-aux
COPY m4 /source/m4
COPY ext /source/ext
COPY .git /source/.git
COPY builder/helpers/set-configure-ac-version.sh /usr/local/bin

COPY builder-support/helpers/install_rust.sh /source/install_rust.sh
COPY builder-support/helpers/rust.json /source/rust.json
RUN cd /source/ && ./install_rust.sh

# build and install (TODO: before we hit this line, rearrange /source structure if we are coming from a tarball)
WORKDIR /source/pdns/recursordist

ARG MAKEFLAGS=
ENV MAKEFLAGS ${MAKEFLAGS:--j2}

ARG DOCKER_FAKE_RELEASE=NO
ENV DOCKER_FAKE_RELEASE ${DOCKER_FAKE_RELEASE}

# Manpage deps
# RUN apt-get install -y python3-venv && apt-get clean

# Manpage prevent
RUN touch pdns_recursor.1 rec_control.1 # avoid installing pandoc

RUN if [ "${DOCKER_FAKE_RELEASE}" = "YES" ]; then \
      BUILDER_VERSION="$(IS_RELEASE=YES BUILDER_MODULES=recursor ./builder-support/gen-version | sed 's/\([0-9]\+\.[0-9]\+\.[0-9]\+\(\(alpha|beta|rc\)\d\+\)\)?.*/\1/')" set-configure-ac-version.sh;\
    fi && \
    BUILDER_MODULES=recursor autoreconf -vfi

RUN mkdir /build && \
    LUAVER=$([ -z "${NO_LUA_JIT##*$(dpkg --print-architecture)*}" ] && echo 'lua5.3' || echo 'luajit') && \
    apt-get install -y lib${LUAVER}-*dev && \
    ./configure \
      --with-libcap \
      --with-libsodium \
      --with-lua=${LUAVER} \
      --with-net-snmp \
      --enable-dns-over-tls \
      --enable-dnstap \
      --enable-nod \
      LDFLAGS=-rdynamic \
      --sysconfdir=/etc/powerdns \
      --enable-option-checking=fatal && \
      make clean && \
      make $MAKEFLAGS install DESTDIR=/build && make clean && \
      strip /build/usr/local/bin/* /build/usr/local/sbin/*
RUN cd /tmp && mkdir /build/tmp/ && mkdir debian && \
    echo 'Source: docker-deps-for-pdns' > debian/control && \
    dpkg-shlibdeps /build/usr/local/bin/rec_control /build/usr/local/sbin/pdns_recursor && \
    sed 's/^shlibs:Depends=/Depends: /' debian/substvars >> debian/control && \
    equivs-build debian/control && \
    dpkg-deb -I equivs-dummy_1.0_all.deb && cp equivs-dummy_1.0_all.deb /build/tmp/

# Runtime
FROM debian:11-slim

# Reusable layer for base update - Should be cached from builder
RUN apt-get update && apt-get -y dist-upgrade && apt-get clean

# Ensure python3 and jinja2 is present (for startup script), and tini for signal management
RUN apt-get install -y python3 python3-jinja2 tini libcap2-bin && apt-get clean

# Executables from builder
COPY --from=builder /build /
RUN chmod 1777 /tmp # FIXME: better not use /build/tmp for equivs at all

# Ensure dependencies are present
RUN apt-get install -y /tmp/equivs-dummy_1.0_all.deb && apt-get clean

# Start script
COPY dockerdata/startup.py /usr/local/sbin/pdns_recursor-startup

# Config file(s) from builder
COPY dockerdata/recursor.conf /etc/powerdns/

# Is recursor.d necessary if we copy the config into recursor.conf? (see above)
RUN mkdir -p /etc/powerdns/recursor.d /var/run/pdns-recursor /etc/powerdns/templates.d

# Work with pdns user - not root
RUN adduser --system --disabled-password --disabled-login --no-create-home --group pdns --uid 953
RUN chown pdns:pdns /var/run/pdns-recursor /etc/powerdns/recursor.d /etc/powerdns/templates.d
USER pdns

# Default DNS ports
EXPOSE 53/udp
EXPOSE 53/tcp

# Default webserver port
EXPOSE 8082/tcp

ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/sbin/pdns_recursor-startup"]