coredns-deployment/docker/dns.yml

version: "3.2"

services:
  coredns:
    image: coredns/coredns
    command: -conf /data/Corefile
    ports:
      - "53:53/udp"
      - "53:53/tcp"
      - "9153:9153/tcp"
    volumes:
      - coredns:/data:ro
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    read_only: true
    deploy:
      mode: global
      placement:
        constraints:
          - "node.labels.iface != extern"
      restart_policy:
        condition: on-failure

volumes:
  coredns:
    external: true
Add Docker 1.12+ (service) based deployment (#9) 2017-08-08 12:02:04 +02:00			`version: "3.2"`

			`services:`
			`coredns:`
			`image: coredns/coredns`
			`command: -conf /data/Corefile`
			`ports:`
			`- "53:53/udp"`
			`- "53:53/tcp"`
			`- "9153:9153/tcp"`
			`volumes:`
Drop unneeded capabilities, make container read-only (#76) * Run CoreDNS in Docker only with CAP_NET_BIND_SERVICE, drop all other (root) privileges. Run filesystem of container and config in read-only mode. * Run CoreDNS in Kubernetes only with CAP_NET_BIND_SERVICE, drop all other (root) privileges. Run filesystem of container and config in read-only mode. 2018-05-29 15:02:00 +02:00			`- coredns:/data:ro`
			`cap_drop:`
			`- ALL`
			`cap_add:`
			`- NET_BIND_SERVICE`
			`read_only: true`
Add Docker 1.12+ (service) based deployment (#9) 2017-08-08 12:02:04 +02:00			`deploy:`
			`mode: global`
			`placement:`
			`constraints:`
			`- "node.labels.iface != extern"`
			`restart_policy:`
			`condition: on-failure`

			`volumes:`
			`coredns:`
			`external: true`