FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02

RUN apt-get update && apt-get install -y \
    unbound \
    iproute2 \
    iputils-ping \
    net-tools \
    dnsutils \
    procps \
    && rm -rf /var/lib/apt/lists/*

RUN chown -R root:unbound /etc/unbound

COPY config/resolver/unbound.conf /etc/unbound/unbound.conf
COPY config/resolver/root.hints /etc/unbound/root.hints
COPY config/routing/resolver-routes.sh /startup.sh
# The off-fleet public resolver runs from the SAME image with a different
# startup (it sits on internet-external, so it needs no route through fw-ext).
# One image, two `command:` values — see docker-compose-generator.ts.
COPY config/routing/public-resolver-routes.sh /public-resolver-startup.sh
RUN chmod +x /startup.sh /public-resolver-startup.sh

EXPOSE 53/tcp 53/udp
CMD ["/startup.sh"]