FROM alpine:3.20

# gettext = envsubst (renders DC IPs from .env into the config)
# bind-tools = dig, used by the compose healthcheck
RUN apk add --no-cache unbound gettext bind-tools ca-certificates

COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

# Starts as root to bind :53 and set IP_FREEBIND, then unbound itself
# drops to the "unbound" user (username: directive in the config).
ENTRYPOINT ["/entrypoint.sh"]