Dockerfile.alpine

# Author: Satish Gaikwad <satish@satishweb.com>

# Version of the upstream DNS over HTTPS server to build.
# https://github.com/m13253/dns-over-https/releases
ARG DOH_VERSION=v2.3.10

# The platform the build itself runs on. BuildKit sets this
# automatically, the fallback is only used by the legacy builder.
ARG BUILDPLATFORM
FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.27-alpine AS doh-build
LABEL MAINTAINER=satish@satishweb.com
ARG DOH_VERSION
# The target platform is used to cross compile the server. The build itself
# always runs on the native platform, which makes multi platform builds fast
# and does not need any emulation.
ARG TARGETOS
ARG TARGETARCH
ARG TARGETVARIANT

RUN apk add --no-cache git make jq curl unzip patch

WORKDIR /src

COPY patches/multiple-paths.patch /tmp/multiple-paths.patch

# Lets download the requested version of DOH
# The canonical Go module proxy is used when it is reachable. Some networks
# block proxy.golang.org, in that case the modules are fetched directly from
# the source repositories instead.
ENV GOPROXY=https://proxy.golang.org,direct
RUN set -x ;\
    if ! curl -fsS --max-time 20 "https://proxy.golang.org/github.com/miekg/dns/@v/list" >/dev/null 2>&1; then \
      echo "proxy.golang.org is not reachable, fetching the modules directly"; \
      export GOPROXY="direct"; \
    fi ;\
    curl -fL "https://github.com/m13253/dns-over-https/archive/${DOH_VERSION}.zip" -o doh.zip \
    && unzip doh.zip \
    && rm doh.zip \
    && cd dns-over-https* \
    && patch -p1 --forward --batch < /tmp/multiple-paths.patch \
    && grep -qE "VERSION[[:space:]]*=[[:space:]]*\"${DOH_VERSION#v}\"" doh-server/version.go \
    && mkdir /dist \
    && if [ -n "${TARGETARCH}" ] && [ "${TARGETARCH}" = "arm" ]; then export GOARM="${TARGETVARIANT#v}"; fi \
    && CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" GOARM="${GOARM:-}" \
       make doh-server/doh-server \
    && cp doh-server/doh-server /dist/doh-server \
    && echo ${DOH_VERSION} > /dist/doh-server.version \
    && go version -m /dist/doh-server | grep -q "m13253/dns-over-https"

FROM alpine:3.24
LABEL MAINTAINER=satish@satishweb.com \
      org.opencontainers.image.title="DNS Over HTTP Server" \
      org.opencontainers.image.description="DNS over HTTPS server based on m13253/dns-over-https" \
      org.opencontainers.image.source="https://github.com/satishweb/docker-doh" \
      org.opencontainers.image.licenses="MIT"
ARG DOH_VERSION
LABEL org.opencontainers.image.version="${DOH_VERSION}"

COPY --from=doh-build /dist /server
COPY doh-server.sample.conf /server/doh-server.sample.conf

# Install required packages by docker-entrypoint
RUN apk add --no-cache bash gettext

# Add docker entrypoint and make it executable
ADD docker-entrypoint /docker-entrypoint
RUN chmod u+x /docker-entrypoint

# Add docker healthcheck and make it executable
COPY docker-healthcheck /docker-healthcheck
# The health check runs as the unprivileged user of the container, so it has to
# be executable for everybody and not only for the owner.
RUN chmod 0755 /docker-healthcheck

# Change owner of the server folder
RUN chown -R nobody:nogroup /server

# Tell docker that all future commands should run as nobody
USER nobody

# Set environment defaults
# We are using OpenDNS DNS server address as default
# Here is the list of addresses: https://use.opendns.com/
ENV UPSTREAM_DNS_SERVER="udp:208.67.222.222:53,udp:208.67.220.220:53"
ENV DOH_HTTP_PREFIX="/getnsrecord"
# Additional paths the resolve endpoint is served on.
# /dns-query is the RFC 8484 standard path used by browsers and cloudflared.
ENV DOH_HTTP_PREFIXES="/dns-query"
ENV DOH_SERVER_LISTEN=":8053"
ENV DOH_SERVER_TIMEOUT="10"
ENV DOH_SERVER_TRIES="3"
ENV DOH_SERVER_VERBOSE="false"
ENV DOH_SERVER_LOG_GUESSED_CLIENT_IP="false"
ENV DOH_SERVER_ECS_ALLOW_NON_GLOBAL_IP="false"
ENV DOH_SERVER_ECS_USE_PRECISE_IP="false"
ENV DOH_SERVER_LOCAL_ADDR=""
# DOH_SERVER_CERT, DOH_SERVER_KEY, DOH_SERVER_TLS_CLIENT_AUTH and
# DOH_SERVER_TLS_CLIENT_AUTH_CA are not declared here. They carry paths and
# flags, not secrets, but a name that holds a key or an auth is reported by
# the build check for secrets in the environment. They default to empty and
# false in the entrypoint.

EXPOSE 8053

ENTRYPOINT ["/docker-entrypoint"]
CMD [ "/server/doh-server", "-conf", "/server/doh-server.conf" ]

# Healthcheck
# The check reads the path from the configuration file that is in use, so it
# stays correct for every path configuration.
HEALTHCHECK --interval=1m --timeout=30s --start-period=1m --retries=3 \
    CMD /docker-healthcheck