BIND9 DNS server packed with the usual bells and whistles.

Make sure you set container's DNS to localhost (127.0.0.1). The container has a built-in health check which tries to resolve a dummy DNS record. If you do not override the DNS, the health check command will be asking the DNS server the host is using instead of the DNS server running inside of this container and will obviously fail.

version: "3.7"
services:
  dns:
    build: .
    dns:
      - 127.0.0.1 # important for health check
    restart: unless-stopped
    volumes:
      # the directory MUST be writable, BIND9 writes jnl files next to the configuration
      - "./example:/config:rw"
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "9000:9000/tcp"

See the example/named.conf for a quickstart or BIND9 documentation for full configuration reference. The root configuration file (named.conf) is expected to be at /config/named.conf. The container contains a piece of built-in configuration which automatically sets up the statistics endpoint and a zone for health check.

The container is regularly scanned for vulnerabilities and updated. Further info can be found in the Security tab.

The container supports privilege drop. Even though the container starts as root, it will use the permissions only to perform the initial set up. The cadvisor process runs as UID/GID provided in the PUID and PGID environment variables.

⚠️ Do not change the container user directly using the user Docker compose property or using the --user argument. This would break the privilege drop logic.