TrueCloudLab/coredns
16
0
Fork 2
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Run coredns as non root. (#5969)

Browse source 
Signed-off-by: Vinayak Goyal <vinaygo@google.com>
This commit is contained in:
Vinayak Goyal 2023-03-20 19:49:59 +05:30 • committed by GitHub
parent 1258e3b2f2
commit d21537f931
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
Dockerfile
View file

@ -1,4 +1,4 @@
FROM --platform=$BUILDPLATFORM debian:stable-slim FROM --platform=$BUILDPLATFORM debian:stable-slim AS build
SHELL [ "/bin/sh", "-ec" ] SHELL [ "/bin/sh", "-ec" ]
RUN export DEBCONF_NONINTERACTIVE_SEEN=true \ RUN export DEBCONF_NONINTERACTIVE_SEEN=true \
@ -7,13 +7,14 @@ RUN export DEBCONF_NONINTERACTIVE_SEEN=true \
TERM=linux ; \ TERM=linux ; \
apt-get -qq update ; \ apt-get -qq update ; \
apt-get -yyqq upgrade ; \ apt-get -yyqq upgrade ; \
apt-get -yyqq install ca-certificates ; \ apt-get -yyqq install ca-certificates libcap2-bin; \
apt-get clean apt-get clean
COPY coredns /coredns
RUN setcap cap_net_bind_service=+ep /coredns
FROM --platform=$TARGETPLATFORM scratch FROM --platform=$TARGETPLATFORM gcr.io/distroless/static-debian11:nonroot
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=0 /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ COPY --from=build /coredns /coredns
ADD coredns /coredns USER nonroot:nonroot
EXPOSE 53 53/udp EXPOSE 53 53/udp
ENTRYPOINT ["/coredns"] ENTRYPOINT ["/coredns"]