i've got notification from Victoria Risk [email protected]
New BIND releases are available: 9.18.35, 9.20.7, 9.21.6
after i pulled latest image, bind9 is now unable to start due to the following new error:
$ docker compose up
[+] Running 2/1
✔ Network bind_bind Created 0.2s
✔ Container bind9 Created 0.0s
Attaching to bind9
bind9 | named: setgid(): Operation not permitted
bind9 exited with code 1
$
bind9 used to work just fine before pulling new latest image..
my environment:
$ uname -a
Linux gamma 6.1.0-26-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.112-1 (2024-09-30) x86_64 GNU/Linux
$ docker --version
Docker version 27.3.1, build ce12230
$ docker compose version
Docker Compose version v2.29.7
$
my docker-compose
$ cat docker-compose.yml
services:
bind:
image: internetsystemsconsortium/bind9:9.20
container_name: bind9
env_file: .env
expose:
- 80
- 443
- 853
networks:
- default
ports:
- 0.0.0.0:53:53/udp
- 0.0.0.0:53:53/tcp
- 0.0.0.0:443:443/tcp
- 0.0.0.0:853:853/tcp
- 127.0.0.1:953:953/tcp
restart: always
volumes:
- ./etc/bind:/etc/bind
- ./var/cache/bind:/var/cache/bind
- ./var/lib/bind:/var/lib/bind
- ./var/log:/var/log
networks:
default:
name: bind_bind
driver: bridge
$
named.conf:
$ cat ./etc/bind/named.conf
# Use with the following in named.conf, adjusting the allow list as needed:
key "rndc-key" {
algorithm hmac-sha256;
secret "XYZ";
};
#
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};
# End of named.conf
logging {
channel stdout {
stderr;
severity debug;
# severity info;
print-category yes;
print-severity yes;
print-time yes;
};
category security { stdout; };
category dnssec { stdout; };
category default { stdout; };
category queries { stdout; };
};
tls local-tls {
key-file "/etc/bind/letsencrypt/X.Y.Z/privkey.pem";
cert-file "/etc/bind/letsencrypt/X.Y.Z/fullchain.pem";
};
http local-http-server {
endpoints { "/dns-query"; };
};
options {
allow-query-cache { any; };
allow-recursion {
X.X.X.X/Y;
};
allow-transfer {
X.X.X.X/Y;
};
allow-update { none; };
directory "/var/cache/bind";
http-port 80;
https-port 443;
listen-on port 53 { any; };
listen-on port 80 tls none http local-http-server { any; };
listen-on port 443 tls local-tls http local-http-server { any; };
listen-on-v6 port 53 { any; };
listen-on-v6 port 80 tls none http local-http-server { any; };
listen-on-v6 port 443 tls local-tls http local-http-server { any; };
max-cache-size 100M;
max-cache-ttl 3600;
max-ncache-ttl 3600;
# https://kb.isc.org/docs/bind-best-practices-authoritative#6-prepare-for-abuse-of-any-externalfacing-servers
rate-limit {
# slip 2; // Every other response truncated
# window 15; // Seconds to bucket
responses-per-second 5;// # of good responses per prefix-length/sec
# referrals-per-second 5; // referral responses
# nodata-per-second 5; // nodata responses
# nxdomains-per-second 5; // nxdomain responses
# errors-per-second 5; // error responses
# all-per-second 20; // When we drop all
# log-only no; // Debugging mode
# pps-scale 250; // x / 1000 * per-second
# // = new drop limit
# exempt-clients { 127.0.0.1; 192.153.154.0/24; 192.160.238.0/24 };
# ipv4-prefix-length 24; // Define the IPv4 block size
# ipv6-prefix-length 56; // Define the IPv6 block size
# max-table-size 20000; // 40 bytes * this number = max memory
# min-table-size 500; // pre-allocate to speed startup
};
version none;
};
$
please advise.
unfortunately internetsystemsconsortium user/team doesn't have 3rd level version specific tag, which makes me unable to do the roll back: https://hub.docker.com/r/internetsystemsconsortium/bind9/tags
