Hey there,
I didn't want to revive my already over 2-year old thread about my recursive Unbound upstream resolver for Pi-hole. I think the evolution of this image deserves a whole new topic. If not feel free to remove or to merge. Thank you 
.
Why would one need an own recursive upstream resolver for Pi-hole?
Hands down, the best description comes from the Pi-hole folks themselves:
The problem: Whom can you trust? Recently, more and more small (and not so small) DNS upstream providers have appeared on the market, advertising free and private DNS service, but how can you know that they keep their promises? Right, you can't.
Furthermore, from the point of an attacker, the DNS servers of larger providers are very worthwhile targets, as they only need to poison one DNS server, but millions of users might be affected. Instead of your bank's actual IP address, you could be sent to a phishing site hosted on some island. This scenario has already happened and it isn't unlikely to happen again...
When you operate your own (tiny) recursive DNS server, then the likeliness of getting affected by such an attack is greatly reduced.
What happened to the former image?
In addition to the usual updates and maintenance of the image, it bobbled along until shortly before the release of Unbound 1.19.1. Right up to the point when an attentive GitHub user pointed out to me that the image could not provide a secure chroot environment. After some adjustments here and there, it worked again in my lab environment, but I had been looking towards a distroless image under Alpine Linux for a long time, preferrably with my usual and already customized dockerfiles and configs since there was a user base already. This was the perfect opportunity to completely rethink everything and also to implement the precious suggestions this attentive user made.
Why distroless?
Imagine a critical system like a DNS server being compromised; with an underlying, possibly inadequately maintained, yet fully functional operating system providing a substantial attack surface supplemented by various nifty tools that could be exploited or even installed by someone with malicious intent.
Well, it seems like it became probably the most innovative and advanced Unbound Docker image currently available - created with great attention to details and modeled according to the principles of "best practice".
| Feature | Supported |
|---|---|
| Single-layer distroless scratch image running Alpine Linux | yes |
| Unprivileged user | yes |
| Unprivileged port (privileged possible) | yes |
| Custom UID/GID enviroment variables | yes |
| Per hardware architecture optimized & CD built OpenSSL build environment | yes |
| Libevent | yes |
| Recursive DNS as default | yes |
| DNSSEC | yes |
| DNSCrypt | yes |
| DNSTap | yes |
| DNS64 | yes |
| DNS over HTTPS | yes |
| DNS over TLS | yes |
| Redis via UNIX Socket | yes |
| Optional privacy respecting & meaningful healthcheck | yes |
| Optional Unbound statistics for Grafana via Zabbix utilizing on-board means | yes |
If you use Unbound, be sure to use Redis as your persistent cache! And then preferably also via Unix Socket for maximum performance.
In the last few days, I have changed the pipeline so that the image is automatically updated via my bot madnuttah-bot when an Unbound update has been released, pushed to Docker Hub, tagged and released with the required signing according to my GitHub repo's strict security policies. My reintroduced optimized and hardened OpenSSL build environment is built in the same way. I still can't believe 'someone else' is doing the chores for me...
I tried to document all the things as good as possible.
In case you dig statistics as much as I do, please have a look at my companion project Unbound Statistics, which transfers Unbound statistics without any additional tools to Zabbix using on-board means via an Active Agent and can then be displayed in Grafana.
Speaking for myself as a developer, I am grateful for you attentive users, only through you are such improvements and changes possible. So that things can be created that are far better than you would have thought possible.