claude generated first pass

unbound/Dockerfile

@@ -0,0 +1,12 @@
+FROM alpine:3.20
+
+# gettext = envsubst (renders DC IPs from .env into the config)
+# bind-tools = dig, used by the compose healthcheck
+RUN apk add --no-cache unbound gettext bind-tools ca-certificates
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+# Starts as root to bind :53 and set IP_FREEBIND, then unbound itself
+# drops to the "unbound" user (username: directive in the config).
+ENTRYPOINT ["/entrypoint.sh"]