Installing unbound via docker compose

Help docker
1

Hi, I'm running two Raspberry Pis in a Docker Swarm configuration. I'm wondering if I'm able to install Unbound as a recursive DNS solution, preferably using a docker compose file since I'm running Portainer as my main dashboard. Below is my current compose file that I'm using (largely copied from the existing guide).

version: "3"

services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "80:80/tcp"
    environment:
      TZ: 'Europe/Amsterdam'
      WEBPASSWORD: '******'
    volumes:
      - "/data/pihole/etc-pihole:/etc/pihole"
      - "/data/pihole/etc-dnsmasq.d:/etc/dnsmasq.d"
    restart: unless-stopped
    deploy:
      placement:
        constraints:
          - node.hostname == cluster-2 # cluster-2 is my second (worker) node

Is this possible? How do I configure it?

2

Under services: you can add another service called unbound: and add your unbound compose settings there:

services:
  pihole:
    ...

  unbound:
    # add your unbound config here
    ...

There are many examples on the Internet, like this one: unbound-docker/examples/pi-hole/docker-compose.yml at 5c44706990088ecf0ee4bf2a5814ed6295630d50 · klutchell/unbound-docker · GitHub

3

I've updated my stack to use the new compose file. It starts fine without errors but my DNS requests are still answered by Google. Do I need to set something on the dashboard still, or is there a way to check if it's working correctly?

4

Did you read the example from my post above?

Did you add this environment variable?

    environment:
      PIHOLE_DNS_: unbound
5

I simply deployed the stack in the wrong way. I think I did it right this time, but my dashboard now displays: Warning in dnsmasq core: no upstream servers configured. I believe this is because my pihole_unbound service isn't going up (stuck at 0/1 replicated, task says ready). Since the logs don't seem to indicate something wrong, could I have misconfigured something in my compose file? I used two examples for this so I might be missing something crucial.

version: "3"

services:
  pihole:
    container_name: pihole
    depends_on:
      - unbound
    image: pihole/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "80:80/tcp"
    environment:
      TZ: 'Europe/Amsterdam'
      WEBPASSWORD: 'xxxxxx'
      PIHOLE_DNS_: unbound
    volumes:
      - "/data/pihole/etc-pihole:/etc/pihole"
      - "/data/pihole/etc-dnsmasq.d:/etc/dnsmasq.d"
    restart: unless-stopped
    deploy:
      placement:
        constraints:
          - node.hostname == cluster-2
  unbound:
    image: klutchell/unbound:latest
    container_name: unbound
    restart: unless-stopped
    deploy:
      placement:
        constraints:
          - node.hostname == cluster-2
    volumes:
      - "/unbound.conf:/etc/unbound/unbound.conf"
    networks:
      - default
    healthcheck:
      # Use the drill wrapper binary to reduce the exit codes to 0 or 1 for healthchecks
      test: ['CMD', 'drill-hc', '@127.0.0.1', 'dnssec.works']
      interval: 30s
      timeout: 30s
      retries: 3

networks:
  default:
    driver: bridge

Sorry if I sound like I want to be spoonfed or similar, I'm just pretty new to this.

6

Did you try without the extra configuration added by you?

    deploy:
      placement:
        constraints:
          - node.hostname == cluster-2

Does it work without this?

7

Hmm, just tried, unfortunately not. I initially added this so I didn't have to deal with pi-hole switching nodes but it doesn't seem to make a difference to this issue.

8

Okay, this thread might start getting a bit confusing but I was able to start the unbound service by modifying the config file a tad, and it starts up without errors (except a small memory warning). I still get the warning however and my DNS requests are still not being answered at all.

Update: after restarting everything the warning goes away and requests do get answered by unbound but it's not being forwarded to the client i.e. the client still can't get websites. The reply just says N/A but the status is OK