FROM alpine:3.15.0

# Install required dependencies and build unbound (and install bind-tools for dig in healthcheck)
RUN apk --update add --no-cache alpine-sdk bind-tools expat-dev git openssl-dev && \
    # Clone and build unbound source (https://github.com/NLnetLabs/unbound)
    git clone --depth 1 --branch 'release-1.14.0' https://github.com/NLnetLabs/unbound.git /tmp/unbound && \
    cd /tmp/unbound && \
    ./configure && \
    make && \
    make install && \
    make clean && \
    # Cleanup build tools
    rm -rf /tmp/* && \
    apk del alpine-sdk expat-dev git openssl-dev

# Prepare unbound files
COPY entrypoint.sh /
RUN mkdir -p /srv/unbound
COPY unbound.conf /srv/unbound/unbound.conf

# Prepare
RUN adduser -S unbound --disabled-password

# Health
HEALTHCHECK --interval=60s --timeout=3s --retries=2 \
    CMD dig ns1.gkcld.net @127.0.0.1 +dnssec || exit 1

ENTRYPOINT ["sh", "/entrypoint.sh"]