Comments (3)
You can run blocky with PSS restrict. PSS restricted allows to add NET_BIND_SERVICE
.
This is how I run blocky in a Namespace with PSS restricted version v1.26: https://git.shivering-isles.com/shivering-isles/infrastructure-gitops/-/blob/37b991bc0f7f4955773bce1df3ef5a0b6ce6cd0f/apps/k8s01/dns/dns.yaml
from blocky.
It requires to drop all capabilities, except NET_BIND_SERVICE
I supposed, that config below should work
securityContext:
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
However, the point is I do not need privileged ports and want to run without NET_BIND_SERVICE
capability. But as this capability is set on executable, I have to add NET_BIND_SERVICE
in K8s or rebuild image.
The propose is to have an image without capabilities set on executable (tagged like v0.23-unprivileged
).
Perhaps, I should have renamed the issue...
from blocky.
ghcr.io/0xerr0r/blocky:v0.24
While I confirm, that configuration below works in my cluster
apiVersion: apps/v1
kind: Deployment
metadata:
name: blocky
spec:
...
containers:
- name: blocky
image: ghcr.io/0xerr0r/blocky:v0.24
ports:
- name: dns-udp
containerPort: 1053
protocol: UDP
- name: dns-tcp
containerPort: 1053
protocol: TCP
- name: http
containerPort: 4000
protocol: TCP
securityContext:
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
securityContext:
runAsUser: 100
runAsGroup: 100
runAsNonRoot: true
fsGroup: 100
fsGroupChangePolicy: OnRootMismatch
seccompProfile:
type: RuntimeDefault
there might be clusters (old versions?) which do not set ambient
capabilities and this configuration/workaround won't work.
Linux Capabilities in OpenShift
Running a container with runAsNonRoot and add capabilities
That said, the dedicated unprivileged image is still preferable solution, I think.
Edit: seems, add NET_BIND_SERVICE
works because it was set up on file.
from blocky.
Related Issues (20)
- root nameserver for blocky config. Need a help HOT 1
- Use semver tags
- Just wanted to share..
- How can I rewrite domain by suffix ?
- ecs and caching.minTime seem to not play nice together..
- conditional/split horizon only answers?
- Custom DNS wildcard for subdomains only HOT 5
- Conditional DNS resolution for wildcards of TLD
- blocky_request_duration_ms_bucket shows artificially inflated data
- one upstream server and strict.. double queries? HOT 1
- Announce DoT/DoH address via _dns.resolver.arpa SVCB record (RFC 9642) HOT 1
- feat: allow customisation of DoH path
- Errors in container without IPv6
- blocky not writing to mariadb docker container
- Initial CPU spike at start up, seems to be around requesting blocklists? HOT 2
- RPM SPEC file
- make build deletes local changes HOT 2
- how to have a device with ip 192.168.1.10 being completly unfiltered, to be full allowlisted (whitelisted) HOT 3
- Scheduled CRON expression to refresh denylists/allowlists
- Control the reverse lookup responses (PTR records) for statically defined domain name mappings in the blocky config HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from blocky.