2023-05-26 15:57:25 +02:00
|
|
|
ARG DEBIAN_IMAGE=debian:stable-slim
|
2024-11-13 00:40:01 +01:00
|
|
|
ARG BASE=gcr.io/distroless/static-debian12:nonroot
|
2016-04-13 20:14:13 +01:00
|
|
|
|
2025-11-09 07:32:23 +13:00
|
|
|
FROM --platform=$BUILDPLATFORM ${DEBIAN_IMAGE} AS build
|
|
|
|
|
ARG DEBIAN_FRONTEND=noninteractive
|
|
|
|
|
RUN apt-get -qq update \
|
|
|
|
|
&& apt-get -qq --no-install-recommends install libcap2-bin
|
2023-03-20 19:49:59 +05:30
|
|
|
COPY coredns /coredns
|
|
|
|
|
RUN setcap cap_net_bind_service=+ep /coredns
|
2016-04-13 20:14:13 +01:00
|
|
|
|
2025-11-09 07:32:23 +13:00
|
|
|
FROM ${BASE}
|
2023-03-20 19:49:59 +05:30
|
|
|
COPY --from=build /coredns /coredns
|
2026-08-06 08:11:02 +04:00
|
|
|
# Use the numeric uid/gid (distroless "nonroot" is 65532) rather than the named
|
|
|
|
|
# user so Kubernetes can verify the image runs as non-root when runAsNonRoot is
|
|
|
|
|
# set. A named user is rejected at admission ("container has runAsNonRoot and
|
|
|
|
|
# image has non-numeric user, cannot verify user is non-root"). The binary keeps
|
|
|
|
|
# cap_net_bind_service (set in the build stage), so it can still bind :53.
|
|
|
|
|
# Refs #7542.
|
|
|
|
|
USER 65532:65532
|
2025-08-05 11:54:18 +12:00
|
|
|
# Reset the working directory inherited from the base image back to the expected default:
|
|
|
|
|
# https://github.com/coredns/coredns/issues/7009#issuecomment-3124851608
|
2024-10-01 18:12:19 +02:00
|
|
|
WORKDIR /
|
2016-04-13 20:14:13 +01:00
|
|
|
EXPOSE 53 53/udp
|
|
|
|
|
ENTRYPOINT ["/coredns"]
|
