unbound-docker

The performance is extraordinary via UnixSocket which I made possible by using a proxy image which holds the redis.sock to make it available to the limited _unbound user. Another thing is that you can set environment variables in your compose file, so the uid and gid ain't hardcoded anymore. Yes @kernbug is a MVP to me. If you use Zabbix and like graphs in Grafana like I do, check out my unbound-docker-stats: https://github.com/madnuttah/unbound-docker-stats which should be usable with any unbound-docker image with my 'frankensteined' healthcheck script. I hope you like what I do and I'm keen to hear your constructive criticism. You'll find the image's sources here: https://github.com/madnuttah/unbound-docker-stats Cheers and all the best, madnuttah Edit: formatting

fore entirely built online using workflows in a GitHub action, uses the very lean Alpine Linux with all its security features and Unbound directly queries a local copy of the root zone, which is kept up-to-date using DNS zone transfers (XFR). Instead of occupying a few hundred megabytes on your harddisk, my image is only about 30 megabytes uncompressed in size. The separate components Libevent and OpenSSL3 are compiled in the build process in their separate workflows and all the downloads, even the Internic files (root.hints and root.zone) are checked using their PGP keys and signature files if available, following my zero-trust policy. Unbound is compiled with hardening security features that most images do not include, such as PIE (Position Independent Executables), which randomizes the application's position in memory which makes attacks more difficult and RELRO (Relocation Read-Only) which also can mitigate exploitations. The image was actually designed as an DNSSEC validating upstream DNS resolver with Pi-hole for adblocking and tracking prevention in mind but it also works perfectly as a standalone server. All Linux architectures are supported, which are currently used by Pi-hole: 386, armv6, armv7, arm64 and amd64. So it also able to run on older Raspberries under Docker. I maintain the image regularly and as soon as included components are updated, security vulnerabilities become known or an update of Unbound is released, the image will be available for you on the Docker registry in a few hours. If anyone would like to contribute to the development, I'm happy to receive a pull request of yours. For any suggestions, questions, comments or even criticism you are very welcome to contact me here on HN or on Mastodon (https://fosstodon.org/@madnuttah). Here is the link to my GitHub repo https://github.com/madnuttah/unbound-docker. You may find the following links useful for testing the security of your DNS or even in case you want to do a before and after comparison if you want to give the image a try: DNS Leak Test: https://www.dnsleaktest.com/ DNSSEC-Test from the University of Duisburg-Essen: https://dnssec.vs.uni-due.de/ GRC's DNS Nameserver Spoofability Test: https://www.grc.com/dns/dns.htm Cheers, madnuttah

ly on my systems at home. All downloads, even the downloads of the root files, are verified with PGP keys and the respective PGP armored signature files where available to provide maximum trust. It's a quite tiny Alpine Linux multiarch image and the architectures are on par with the architectures Pi-hole uses. In fact, it is a perfect complement for Pi-hole as an upstream server if you are already running Pi-hole for ad blocking and tracking prevention. As I wrote on my GitHub page, it was created with Pi-hole in mind. And with lots of love. I hope you enjoy the image and forgive me my shameless promotion^^ of my open source project. :) Just come and visit my GitHub repository https://github.com/madnuttah/unbound-docker if you'd like to learn more about this project. If you'd like to contribute, you're very welcome. Cheers and wishing all the best, madnuttah