Repository navigation
Harden entry script and run Unbound unprivileged - #1
Merged
Merged
Conversation
tests/smoke.sh runs the image like the Supervisor does (host network, root-owned /data volume), checks resolution, DNSSEC and a restart, and can additionally assert an unprivileged start with --hardened. CI uses the functional mode for now; ShellCheck also covers the new script. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01U8kiCNC4Fjf3vUb6HwLegP
Run with set -euo pipefail and evaluate unbound-anchor explicitly: it returns 1 after creating or updating the anchor and can return 0 on write errors, so the existence of the anchor file now decides whether the resolver starts. ShellCheck runs pinned (v0.11.0) with the busybox dialect, which supports pipefail. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01U8kiCNC4Fjf3vUb6HwLegP
The container now starts as user unbound. The Supervisor mounts /data root-owned on a fresh install, so the trust anchor moves into the image (/var/lib/unbound, owned by unbound) and is refreshed by unbound-anchor on start; Unbound no longer needs to setuid, chown or bind below 1024. CI enforces this with the smoke test in --hardened mode. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01U8kiCNC4Fjf3vUb6HwLegP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tests/smoke.sh): resolution, DNSSEC, restart, optional unprivileged-start checksset -euo pipefailand explicitunbound-anchorresult handling (1.0.1)unbound; trust anchor lives in the image instead of root-owned/data(1.1.0)Test plan
tests/smoke.sh --hardenedfails on 1.0.0 and passes on 1.1.0🤖 Generated with Claude Code
https://claude.ai/code/session_01U8kiCNC4Fjf3vUb6HwLegP