mirror of
https://github.com/notherealmarco/coredns-deployment.git
synced 2025-03-14 14:16:16 +01:00
aba0245609
* Run CoreDNS in Docker only with CAP_NET_BIND_SERVICE, drop all other (root) privileges. Run filesystem of container and config in read-only mode. * Run CoreDNS in Kubernetes only with CAP_NET_BIND_SERVICE, drop all other (root) privileges. Run filesystem of container and config in read-only mode.
28 lines
498 B
YAML
28 lines
498 B
YAML
version: "3.2"
|
|
|
|
services:
|
|
coredns:
|
|
image: coredns/coredns
|
|
command: -conf /data/Corefile
|
|
ports:
|
|
- "53:53/udp"
|
|
- "53:53/tcp"
|
|
- "9153:9153/tcp"
|
|
volumes:
|
|
- coredns:/data:ro
|
|
cap_drop:
|
|
- ALL
|
|
cap_add:
|
|
- NET_BIND_SERVICE
|
|
read_only: true
|
|
deploy:
|
|
mode: global
|
|
placement:
|
|
constraints:
|
|
- "node.labels.iface != extern"
|
|
restart_policy:
|
|
condition: on-failure
|
|
|
|
volumes:
|
|
coredns:
|
|
external: true
|