jmuchovej/zerodns

A ZeroTier-DNS to allow for human-readable names of ZeroTier peers.

zerodns's Issues

Create Docker Container

Constraints:

• Should follow S6
  Should have crontab to update-hosts and update-coredns every 15 minutes

Enable ZeroTier to be optionally included

Modify Dockerfile to "export" two images:

• With ZeroDNS + CoreDNS. (The current jmuchovej/zerodns achieves this.)
• With ZeroDNS + CoreDNS + ZeroTier One client.

Ideally, this can rely on build stages. Unclear if build stages support multiple exports, though.

At worst, this becomes another job in the Docker Builds workflow which uses the latest version of jmuchovej/zerodns but adds ZeroTier. (i.e. this splits the current Dockerfile into base.Dockerfile and with-zerotier.Dockerfile.)

Gauge interaction with VPNs

Please refer to this Discussion.

(Locked to ensure that discussion takes place appropriately.)

Add custom DNS servers

Goals

• Allow for specifying custom DNS servers
• Test if it works as a non-local DNS

Fix resolution speed

While consolidating the Corefile (as below) makes maintenance easy, it seems like it overall slows down connection resolving.

zerodns/root/app/Corefile

Lines 1 to 10 in 00862d0

	.:5353 {
	errors
	log
	hosts /config/hosts {
	reload 15m
	fallthrough
	}
	forward . /etc/resolv.conf
	reload 15m
	}

I'm not sure if this is because of all the aliases generated (at least 6 per IP address), or if these some kind of timeout to be tweaked. So far, question has been asked on CoreDNS's Discussion board.

Check necessity of `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities.

Binding to port 53 seems to require CAP_NET_BIND_SERVICE.

Further, having ZeroTier run within the container appears to require CAP_SYS_ADMIN and CAP_NET_ADMIN. Based on my understanding of cap_add – CAP_SYS_ADMIN should include CAP_NET_ADMIN... but, CAP_SYS_ADMIN also gets pretty close to root's capabilities – which (ideally) isn't necessary.

• Need to develop a better understanding of CAP_SYS_ADMIN.
• Need to develop a better understanding of CAP_NET_ADMIN.
• Test what capabilities are required for running CoreDNS, strictly.
• Test what capabilities are required for running ZeroTier, strictly.

Run ZeroTier in Container