Our local setup for running a recent BIND version via Docker.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
David Blacka 7942b583a7
Update 'README.md'
3 weeks ago
cache add directories 4 weeks ago
cfg disable the chatty query channel 3 weeks ago
log/named add directories 4 weeks ago
zones Update child ns-set for ecotroph.net 3 weeks ago
.gitattributes remove accidental secondary; git-crypt setup 4 weeks ago
.gitignore ensure zones/secondary exists 4 weeks ago
README.md Update 'README.md' 3 weeks ago
docker.named.service we cannot successfully pull from docker.io without DNS 4 weeks ago
run_bind_container.sh Merge branch 'main' of /home/davidb/site/blacka.com/software/repos/docker_bind into main 4 weeks ago
run_named-checkconf.sh add/adjust docker exec scripts 4 weeks ago
run_rndc.sh add/adjust docker exec scripts 4 weeks ago
setup.sh add setup.sh 4 weeks ago


zeke.ecotroph.net DNS service

This repo and directory consists of the revamped DNS service for zeke.ecotroph.net. The goals of this service are:

  1. Host the primary zones we want.
  2. DNSSEC-sign those primary zones, if desired.
  3. Provide local recursive service for the host itself.


In the past, we just ran the version of BIND that came with our distribution (at this moment, that is CentOS 7, which translates to bind 9.11.) This new configuration runs a very recent version of BIND 9 via a docker image produced by ISC themselves. We are starting with 9.18.12.

This docker image imposes a few requirements:

  • Internally, the image runs named as the bind user (104:105). Since we bind-mount directories, we do need those directories owned by whatever internal UID it is using.
  • We need some way to ensure that our container is run on system reboots, etc. Here we chose to use systemd to do this, although that is not ideal.
  • Presumably the normal way to do logging for a docker container is to use the standard journal service, although this image is set up to bind-mount /var/log. On the other hand, the standard command uses the -g flag, which is "debug" mode, and causes all of the logs to go to stderr.
  • We do want named to stay in the foreground here. Fortunately, there have always been command line options that do this (-g and -f). Thus, in order to log to /var/log, we supply a different command: /usr/sbin/named -f -4 -u bind. This will run in the forground, only do IPv4 (zeke does not yet have IPv6 connectivity), and run as the internal bind user.


I have this in a local git repository on zeke, however we can see it here: https://blacka.com/git/docker_bind.git.


We have in this repo:

  • named configurations. I've broken this up into sections (options, keys, logging, primary, secondary, etc.), which all just get included in the primary named.conf. It isn't tricky.
  • "keys". Well, mostly TSIG keys. Those are are but are encrypted with git-crypt. With a key that is ... somewhere. I've saved it in my password manager, but it can be extracted from the current checkout in /etc/bind with cd /etc/bind; git-crypt export-key /tmp/docker_bind_crypto.key. git-crypt doesn't seem to come via RPM and yum, but I build the code and installed it into /usr/local/bin on zeke.
  • zone files. I have all of the zone files we started with, although currently the configuration does not load all of them.
  • A script to launch the container (run_bind_container.sh).
  • A script to use as the internal "command" (cfg/run.sh) -- it isn't config, but we need to bind-mount it. I could possibly be moved to cache.
  • A helper script to run rndc that just runs that inside the container itself (via a docker exec). You would need to be in the docker group to run it. Another helper script to run named-checkconf.
  • A helper script to prepare zeke to run this container and properly work, in case we want to do this install again (setup.sh).


  1. Clone this repo to /etc/bind (clone in /etc -- we want the working copy to be /etc/bind.)
  2. Create a user to match the internal user (uid 104): useradd -u 104 -g 105 -M --no-log-init bind
  3. Change the ownership of everything under /etc/bind to the bind user and group: chown -R 104:105 /etc/bind.
  4. Copy the supplied systemd unit file to /etc/systemd/system, and systemctl enable docker.bind.service, then systemctl start docker.bind.service.

Zone Changes

All of our zone files are now in this git repo, so we can just make changes and commit them, assuming you have write access to the local repo, that is. The bind user should be able to do it, though. Once you've changed your zone, you could bounce the service via systemctl, or we could use rndc. I've made a little script that will do this with docker exec, /etc/bind/run_rndc.sh. Thus:

sudo -u bind -s
cd /etc/bind/zones
vi <zonefile> # remember to update the serial
git commit -a <zonefile>
git push
cd ..
./run_rndc.sh reload <zone>


More modern BIND releases have changed the configuration for this. Note how your zone is signed is based on a dnssec-policy block (I've put those in cfg/named.dnssec.conf). Then, in your zone, you add:

  dnssec-policy "default_alg13";
  inline-signing yes;

in your zone block. After restarting/reconfiguring BIND, it will create a .signed and .signed.jnl file, and start serving a DNSSEC signed version of the zone. It will then take care of resigning activities, key rollovers etc.