Merge ~bryce/ubuntu-docker-images/+git/bind9:initial-implementation into ~ubuntu-docker-images/ubuntu-docker-images/+git/bind9:main

[Bryce Harrington]

Initial OCI for bind9.

I also have a bind9_test.sh prepared for oci-unit-tests however it appears to expect the image to exist in a remote repository in order to run it. At least, I haven't sorted out how to run it entirely locally. So that is still TBD, and may require some adjustments to this image once it does run. That said, I *think* this image is more or less ready for review.

[Sergio Durigan Junior (sergiodj)]

Thanks for the MP, Bryce.

I found some spots that need fixing/adjustments, so I'm leaving comments where applicable. I haven't tested the microk8s service; will do that later.

As for your comment regarding running the unit tests using locally-built images, you can use the DOCKER_IMAGE variable to do that:

# DOCKER_IMAGE=test/bind9 sh bind9_test.sh

review: Needs Fixing

[Bryce Harrington (bryce)]

Thanks for the review, I've made the changes as suggested.
It looks like a lot of the containers use ports in the 3xxxx range so am using 30053 for the external port.

I noticed the link to the example files was also incorrect (yay cargo culting) and have updated it to point at where the example config will be.

[Bryce Harrington (bryce)]

I've also updated the copyright holder in the license, but let me know if it should be done differently.

[Sergio Durigan Junior (sergiodj)]

Thanks, Bryce.

Re. the copyright holder, I think that's the right thing to do but IANAL. I'll talk to Valentin, because some of our other images have the same problem. Meanwhile, could you please remove the LICENSE file from the commit? I'm not even sure if we want to license this work using BSD-3-Clause or if we'll use another license...

As for the other changes, they look good now modulo a few nits. I wasn't able to build the Impish version of the image, but I did build the Hirsute one and it looks fine. Looking forward to running the unit tests for it.

+1, LGTM.

review: Approve

[Bryce Harrington (bryce)]

On Thu, Sep 09, 2021 at 08:10:25PM -0000, Sergio Durigan Junior wrote:
> Review: Approve
>
> Thanks, Bryce.
>
> Re. the copyright holder, I think that's the right thing to do but IANAL. I'll talk to Valentin, because some of our other images have the same problem. Meanwhile, could you please remove the LICENSE file from the commit? I'm not even sure if we want to license this work using BSD-3-Clause or if we'll use another license...
>

Sure. Looks like this was just inherited from deriving off memcached.
Looking at some of the other OCI files, looks like this generally is
just the license of the packaged software itself. For bind9 that
appears to be MPLv2.0. In some cases where the OCI image derives from a
pre-existing docker image's git repo that might make sense but leaves
inconsistency across the packages.

It'll be good to get Valentin's direction, this isn't something I'd be
comfortable deciding either. But having a policy established would be
of value going forward.

> As for the other changes, they look good now modulo a few nits. I wasn't able to build the Impish version of the image, but I did build the Hirsute one and it looks fine. Looking forward to running the unit tests for it.
>
> +1, LGTM.

Thanks. I've added the suggested changes and will land to the main
repo.

Bryce

> Diff comments:
>
> > diff --git a/Dockerfile b/Dockerfile
> > new file mode 100644
> > index 0000000..1d001d6
> > --- /dev/null
> > +++ b/Dockerfile
> > @@ -0,0 +1,30 @@
> > +FROM ubuntu:impish
> > +
> > +ENV TZ UTC
> > +ENV BIND_USER bind
>
> No need for BIND_USER here.
>
> > +
> > +RUN set -eux; \
> > +# installation
> > + apt-get update; \
> > + DEBIAN_FRONTEND=noninteractive apt-get full-upgrade -y; \
> > + DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
> > + bind9 \
> > + bind9-utils \
> > + tzdata \
> > + ; \
> > + DEBIAN_FRONTEND=noninteractive apt-get remove --purge --auto-remove -y; \
> > + rm -rf /var/lib/apt/lists/*; \
> > +# smoke test
> > + named -v; \
> > +# create manifest
> > + mkdir -p /usr/share/rocks; \
> > + (echo "# os-release" && cat /etc/os-release && echo "# dpkg-query" && dpkg-query -f '${db:Status-Abbrev},${binary:Package},${Version},${source:Package},${Source:Version}\n' -W) > /usr/share/rocks/dpkg.query
> > +
> > +USER bind
> > +VOLUME ["/var/cache/bind", "/var/lib/bind"]
> > +
> > +EXPOSE 53
> > +
> > +COPY docker-entrypoint.sh /usr/local/bin/
> > +ENTRYPOINT ["docker-entrypoint.sh"]
> > +CMD docker-entrypoint.sh
>
> You don't need the CMD statement here.
>
> > diff --git a/data/bind9.yaml b/data/bind9.yaml
> > new file mode 100644
> > index 0000000..45b6dfc
> > --- /dev/null
> > +++ b/data/bind9.yaml
> > @@ -0,0 +1,34 @@
> > +application: Bind9
> > +main: true
> > +repo: bind9
> > +description: >
> > + BIND 9 provides software for Domain Name System (DNS) management including both defining domain names authoritatively for a given DNS zone, and recursively resolving domain names to their IP addresses.
> > + In addition to BIND 9's DNS server itself, `named`, this container also includes tools for performing DNS queries and dynamic updates.
> > + Read more on the [BIND 9 webs...

diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..9f84af0
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,28 @@
+FROM ubuntu:impish
+
+ENV TZ UTC
+
+RUN set -eux; \
+# installation
+	apt-get update; \
+	DEBIAN_FRONTEND=noninteractive apt-get full-upgrade -y; \
+	DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+		bind9 \
+		bind9-utils \
+		tzdata \
+		; \
+	DEBIAN_FRONTEND=noninteractive apt-get remove --purge --auto-remove -y; \
+	rm -rf /var/lib/apt/lists/*; \
+# smoke test
+	named -v; \
+# create manifest
+	mkdir -p /usr/share/rocks; \
+	(echo "# os-release" && cat /etc/os-release && echo "# dpkg-query" && dpkg-query -f '${db:Status-Abbrev},${binary:Package},${Version},${source:Package},${Source:Version}\n' -W) > /usr/share/rocks/dpkg.query
+
+USER bind
+VOLUME ["/var/cache/bind", "/var/lib/bind"]
+
+EXPOSE 53
+
+COPY docker-entrypoint.sh /usr/local/bin/
+ENTRYPOINT ["docker-entrypoint.sh"]
diff --git a/HACKING.md b/HACKING.md
new file mode 100644
index 0000000..26ac0d9
--- /dev/null
+++ b/HACKING.md
@@ -0,0 +1,55 @@
+# Contributing
+
+In Ubuntu, Bind9 is available as a `.deb` package.  For this reason,
+this image was built by installing the Bind9 Ubuntu 21.10 package
+inside a docker container.
+
+In order to contribute to the Bind9 OCI image, do the following:
+
+* Create a new branch.
+
+* Make your changes. Keep your commits logically separated. If it is
+  fixing a bug do not forget to mention it in the commit message.
+
+* Build a new image with your changes. You can use the following command:
+
+```
+$ docker build -t ubuntu/bind9:test .
+```
+
+* Test the new image. Run it in some way that exercises your changes,
+  you can also check the README.md file.
+
+* If everything goes well submit a merge proposal.
+
+# Generating the documentation
+
+The documentation (`README.md`) is generated using templates.  In
+order to do that, you need to follow some steps.
+
+```
+$ pwd
+~/work/bind9
+$ cd ..
+$ git clone https://github.com/misterw97/RenderDown
+$ cd bind9
+$ make all-doc
+```
+
+If you already have the `RenderDown` repository cloned somewhere else,
+you can tell `make` about it:
+
+```
+$ RENDERDOWN=/path/to/renderdown.py make all-doc
+```
+
+# Hacking the documentation templates
+
+The repository containing the templates is located at:
+
+https://code.launchpad.net/~canonical-server/ubuntu-docker-images/+git/templates
+
+The specific data for this image's template can be found inside the
+`data/` directory, in the image's own repository.
+
+
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..ea11f99
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,26 @@
+RENDERDOWN ?= ../RenderDown/renderdown.py
+PYTHON ?= python3
+
+README_TEMPLATE = templates/README_DOCKERHUB.md
+
+HACKING_TEMPLATE = templates/HACKING_deb.md
+
+all: all-doc
+
+all-doc: clean-doc readme
+
+get-templates:
+	wget -nv -e "robots=off" -nd -r -np -P templates https://git.launchpad.net/~canonical-server/ubuntu-docker-images/+git/templates/plain/templates/
+
+readme: get-templates
+	mv -v $(README_TEMPLATE) templates/README.md
+	mv -v $(HACKING_TEMPLATE) templates/HACKING.md
+	$(PYTHON) $(RENDERDOWN) templates/README.md > README.md
+	$(PYTHON) $(RENDERDOWN) templates/HACKING.md > HACKING.md
+
+clean: clean-doc
+
+clean-doc:
+	rm -frv templates/ README.md
+
+.PHONY: readme clean clean-doc all all-doc get-templates
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..aa9e1d8
--- /dev/null
+++ b/README.md
@@ -0,0 +1,86 @@
+# Bind9 | Ubuntu
+
+Current Bind9 Docker Image from Ubuntu. Receives security updates and rolls to newer Bind9 or Ubuntu LTS. This repository is exempted from per-user rate limits. For [LTS Docker Image](https://ubuntu.com/security/docker-images) versions of this image, see `lts/bind9`. 
+
+
+## About Bind9
+
+BIND 9 provides software for Domain Name System (DNS) management including both defining domain names authoritatively for a given DNS zone, and recursively resolving domain names to their IP addresses. In addition to BIND 9's DNS server itself, `named`, this container also includes tools for performing DNS queries and dynamic updates. Read more on the [BIND 9 website](https://www.isc.org/bind/).
+
+
+## Tags and Architectures
+![LTS](https://assets.ubuntu.com/v1/0a5ff561-LTS%402x.png?h=17)
+Up to 5 years free security maintenance `from lts/bind9`.
+
+![ESM](https://assets.ubuntu.com/v1/572f3fbd-ESM%402x.png?h=17)
+Up to 10 years customer security maintenance `from store/canonical/bind9`.
+
+_Tags in italics are not available in ubuntu/bind9 but are shown here for completeness._
+
+| Channel Tag | | | Currently | Architectures |
+|---|---|---|---|---|
+| **`9.16-21.10_beta`**    | | | Bind9 9.16.15 on Ubuntu 21.10 | `amd64`, `arm64`, `ppc64el`, `s390x` |
+| _`track_risk`_ |
+
+Channel tag shows the most stable channel for that track ordered `stable`, `candidate`, `beta`, `edge`. More risky channels are always implicitly available. So if `beta` is listed, you can also pull `edge`. If `candidate` is listed, you can pull `beta` and `edge`. When `stable` is listed, all four are available. Images are guaranteed to progress through the sequence `edge`, `beta`, `candidate` before `stable`.
+
+
+## Usage
+
+Launch this image locally:
+
+```sh
+docker run -d --name bind9-container -e TZ=UTC -p 30053:53 ubuntu/bind9:9.16-21.10_beta
+```
+Access your Bind9 server at `localhost:30053`
+
+#### Parameters
+
+| Parameter | Description |
+|---|---|
+| `-e TZ=UTC` | Timezone. |
+| `-p 1803233` | Expose bind9 on `localhost:30053`. |
+| `-v /path/to/bind/configuration:/etc/bind/named.conf` | Local [configuration file](https://bind9.readthedocs.io/en/latest/reference.html) `named.conf` (try [this example](https://git.launchpad.net/~canonical-server/ubuntu-docker-images/+git/bind9/plain/examples/caching-nameserver/named.conf.options)). |
+
+
+#### Testing/Debugging
+
+To debug the container:
+
+```sh
+docker logs -f bind9-container
+```
+
+To get an interactive shell:
+
+```sh
+docker exec -it bind9-container /bin/bash
+```
+
+
+## Deploy with Kubernetes
+
+Works with any Kubernetes; if you don't have one, we recommend you [install MicroK8s](https://microk8s.io/) and `microk8s.enable dns storage` then `snap alias microk8s.kubectl kubectl`.
+
+Download
+[bind9-deployment.yml](https://git.launchpad.net/~canonical-server/ubuntu-docker-images/+git/bind9/plain/examples/bind9-deployment.yml) and set `containers.bind9.image` in `bind9-deployment.yml` to your chosen channel tag (e.g. `ubuntu/bind9:9.16-21.10_beta`), then:
+
+```sh
+kubectl apply -f bind9-deployment.yml
+```
+
+You will now be able to connect to the Bind9 server on localhost:30053`.
+
+## Bugs and feature requests
+
+If you find a bug in our image or want to request a specific feature, please file a bug here:
+
+[https://bugs.launchpad.net/ubuntu-docker-images/+filebug](https://bugs.launchpad.net/ubuntu-docker-images/+filebug)
+
+Please title the bug "`bind9: <issue summary>`". Make sure to include the digest of the image you are using, from:
+
+```sh
+docker images --no-trunc --quiet ubuntu/bind9:<tag>
+```
+
+
diff --git a/data/bind9.yaml b/data/bind9.yaml
new file mode 100644
index 0000000..ce30737
--- /dev/null
+++ b/data/bind9.yaml
@@ -0,0 +1,40 @@
+application: Bind9
+main: true
+repo: bind9
+description: >
+  BIND 9 provides software for Domain Name System (DNS) management including both defining domain names authoritatively for a given DNS zone, and recursively resolving domain names to their IP addresses.
+  In addition to BIND 9's DNS server itself, `named`, this container also includes tools for performing DNS queries and dynamic updates.
+  Read more on the [BIND 9 website](https://www.isc.org/bind/).
+version: "9.16.15"
+base: Ubuntu 21.10
+architectures:
+  - amd64
+  - arm64
+  - ppc64el
+  - s390x
+docker:
+  parameters:
+    - -p 30053:53
+  access: Access your Bind9 server at `localhost:30053`
+parameters:
+  - type: -e
+    value: TZ=UTC
+    description: Timezone.
+  - type: -p
+    value: 30053:53
+    description: Expose bind9 on `localhost:30053`.
+  - type: -v
+    value: /path/to/bind/configuration:/etc/bind/named.conf
+    description: Local [configuration file](https://bind9.readthedocs.io/en/latest/reference.html) `named.conf` (try [this example](https://git.launchpad.net/~canonical-server/ubuntu-docker-images/+git/bind9/plain/examples/caching-nameserver/named.conf.options)).
+  - type: -v
+    value: /path/to/cached/data:/var/cache/bind
+    description: Location where locally cached data can be dumped.
+  - type: -v
+    value: /path/to/resource/records:/var/lib/bind
+    description: Location of Resource Records defining various domain information.
+debug:
+  - nothing
+microk8s:
+  deploy:
+    link: https://git.launchpad.net/~canonical-server/ubuntu-docker-images/+git/bind9/plain/examples/bind9-deployment.yml
+    access: You will now be able to connect to the Bind9 server on localhost:30053`.
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
new file mode 100755
index 0000000..c0cf2fd
--- /dev/null
+++ b/docker-entrypoint.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+set -e
+
+# allow arguments to be passed to named
+if [[ "${1:0:1}" == '-' ]]; then
+    EXTRA_ARGS="${*}"
+    set --
+elif [[ "${1}" == "named" || "${1}" == "$(command -v named)" ]]; then
+    EXTRA_ARGS="${*:2}"
+    set --
+fi
+
+# default behaviour is to launch named
+if [[ -z "${1}" ]]; then
+    echo "Starting named..."
+    echo "exec $(which named) -g \"${EXTRA_ARGS}\""
+    exec $(command -v named) -g ${EXTRA_ARGS}
+else
+    exec "${@}"
+fi
diff --git a/examples/README.md b/examples/README.md
new file mode 100644
index 0000000..d69b8a8
--- /dev/null
+++ b/examples/README.md
@@ -0,0 +1,43 @@
+# Running the examples
+
+## docker-compose
+
+Install `docker-compose` from the Ubuntu archive:
+
+```
+$ sudo apt install -y docker-compose
+```
+
+Call `docker-compose` from the examples directory:
+
+```
+$ docker-compose up -f docker-compose.yml -d
+```
+
+Bind9 will be listening on port `53` in your host. To stop it run:
+
+```
+$ docker-compose -f docker.compose.yml down
+```
+
+# Microk8s
+
+Install microk8s from snap:
+
+```
+$ snap install microk8s --classic
+```
+
+With microk8s running, enable the `dns` and `storage` add-ons:
+
+```
+$ microk8s enable dns storage
+```
+
+Apply the `microk8s-deployments.yml`:
+
+```
+$ microk8s kubectl apply -f microk8s-deployments.yml
+```
+
+Bind9 will be listening on port `53` in your host.
diff --git a/examples/bind9-deployment.yml b/examples/bind9-deployment.yml
new file mode 100644
index 0000000..72cc563
--- /dev/null
+++ b/examples/bind9-deployment.yml
@@ -0,0 +1,35 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: bind9-service
+  labels:
+    app: bind9
+spec:
+  selector:
+    app: bind9
+  ports:
+  - port: 53
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bind9-deployment
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: bind9
+  template:
+    metadata:
+      labels:
+        app: bind9
+    spec:
+      containers:
+      - name: bind9
+        image: ubuntu/bind9:edge
+        env:
+        ports:
+        - containerPort: 53
+          name: bind9
+          protocol: TCP
diff --git a/examples/caching-nameserver/README.md b/examples/caching-nameserver/README.md
new file mode 100644
index 0000000..7709c01
--- /dev/null
+++ b/examples/caching-nameserver/README.md
@@ -0,0 +1,24 @@
+## Caching Nameserver
+
+When configured as a caching nameserver BIND9 will find the answer to name queries and remember the answer when the domain is queried again.
+
+The default configuration acts as a caching server. Simply uncomment and edit `/etc/bind/named.conf.options` to set the IP addresses of your ISP’s DNS servers:
+
+```
+forwarders {
+    1.2.3.4;
+    5.6.7.8;
+};
+```
+
+> ** Note**
+>
+> Replace `1.2.3.4` and `5.6.7.8` with the IP Addresses of actual nameservers.
+
+To enable the new configuration, restart the DNS server. From a terminal prompt:
+
+    sudo systemctl restart bind9.service
+
+See [dig](https://ubuntu.com/server/docs/service-domain-name-service-dns#heading--dns-primarymaster-configuration) for information on testing a caching DNS server.
+
+For full documentation about configuring Ubuntu's bind9 service, please see the [Ubuntu Server Guide - Domain Name Service](https://ubuntu.com/server/docs/service-domain-name-service-dns).
diff --git a/examples/caching-nameserver/named.conf.options b/examples/caching-nameserver/named.conf.options
new file mode 100644
index 0000000..f989298
--- /dev/null
+++ b/examples/caching-nameserver/named.conf.options
@@ -0,0 +1,26 @@
+options {
+	directory "/var/cache/bind";
+
+	// If there is a firewall between you and nameservers you want
+	// to talk to, you may need to fix the firewall to allow multiple
+	// ports to talk.  See http://www.kb.cert.org/vuls/id/800113
+
+	// If your ISP provided one or more IP addresses for stable 
+	// nameservers, you probably want to use them as forwarders.  
+	// Uncomment the following block, and insert the addresses replacing 
+	// the all-0's placeholder.
+
+	// Set the IP addresses of your ISP's DNS servers:
+	// forwarders {
+	//	1.2.3.4;
+	//	5.6.7.8;
+	// };
+
+	//========================================================================
+	// If BIND logs error messages about the root key being expired,
+	// you will need to update your keys.  See https://www.isc.org/bind-keys
+	//========================================================================
+	dnssec-validation auto;
+
+	listen-on-v6 { any; };
+};
diff --git a/examples/docker-compose.yml b/examples/docker-compose.yml
new file mode 100644
index 0000000..c28d76d
--- /dev/null
+++ b/examples/docker-compose.yml
@@ -0,0 +1,7 @@
+version: '3'
+
+services:
+    bind9:
+        image: ubuntu/bind9:edge
+        ports:
+            - '53:53'