New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
How to configure to build a fully static unbound #91
Comments
Hi, Have you tried |
Yes but it gives me symbol not found errors. I can post the errors here later today. |
That would be helpful. Please also provide the |
I use FROM alpine:3.10 AS build
ARG UNBOUND_VERSION=1.9.4
WORKDIR /tmp/unbound
RUN apk add --update --progress -q ca-certificates build-base libressl-dev expat-dev libcap
RUN wget -q https://nlnetlabs.nl/downloads/unbound/unbound-${UNBOUND_VERSION}.tar.gz -O unbound.tar.gz && \
tar -xzf unbound.tar.gz --strip-components=1 && \
rm unbound.tar.gz
RUN ./configure --enable-static-exe
RUN make
FROM scratch
COPY --from=build --chown=1000 /tmp/unbound/unbound /unbound
ENTRYPOINT [ "/unbound" ] And entering docker build -t unbound .
docker run -it --rm unbound On the other hand, building without It may be related to musl that is used in Alpine perhaps. |
Actually, I just tried with Debian and the build works, but running root@6102d77a2446:/tmp/unbound# ldd unbound
linux-vdso.so.1 (0x00007ffd13994000)
libssl.so.1.1 => /usr/lib/x86_64-linux-gnu/libssl.so.1.1 (0x00007f963d4c9000)
libcrypto.so.1.1 => /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 (0x00007f963d1e3000)
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f963d1c2000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f963d001000)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f963cffc000)
/lib64/ld-linux-x86-64.so.2 (0x00007f963d645000) So it does not work with the Scratch Docker image as it depends on those libraries Error is The Dockerfile I used is attached. |
Trying |
Using I made it work using the following:
In order to make your docker (scratch) setup work you additionally need:
Can you give it a try and let me know if that works for you? We are also thinking on adding a configure option that would produce a fully statically linked binary in the future. |
Thanks so much, this is actually for an already existing Docker image doing DNS over TLS using Unbound, so I'm familiar with the configuration options etc, I was just really struggling understanding your configure/Makefile but now it should work! Plus you gave me extra information I will test it tonight and return to you to let you know how it went. |
The build succeeds, and it works on Scratch (as in, you can run it). I am testing it on another Alpine container for now. Here are a few additional questions!
|
|
Thanks for the tips!
|
For 2), I have found the issue being yet another quirk of Linux, where running |
Did you try |
Oh actually I was wrong sorry, the Unbound size was 10MB. Running I will ping back here once it's on Scratch in production. I need to first write a little static program to configure the Docker container, as for now on Alpine it's a shell entrypoint script. |
…c build if requested; in relation to #91.
* nlnet/master: - Fix NLnetLabs#99: Memory leak in ub_ctx (event_base will never be freed). Add new configure option `--enable-fully-static` to enable full static build if requested; in relation to NLnetLabs#91. Changelog note for NLnetLabs#97. - Merge NLnetLabs#97: manpage: Add missing word on unbound.conf, from Erethon. manpage: Add missing word on unbound.conf - drop-tld.diff: adds option drop-tld: yesno that drops 2 label queries, to stop random floods. Apply with patch -p1 < contrib/drop-tld.diff and compile. From Saksham Manchanda (Secure64). Please note that we think this will drop DNSKEY and DS lookups for tlds and hence break DNSSEC lookups for downstream clients.
Hi there,
First of all, thank you for the great application.
I am trying to build Unbound (only
unbound
) fully statically so it can run on a Docker Scratch image which cannot have any libraries installed.However, I can't seem to manage to build it fully statically. What would be the
./configure
flags to do so? Or what environment variables could be set?Thank you in advance
The text was updated successfully, but these errors were encountered: