{"id":306,"date":"2026-01-26T03:43:12","date_gmt":"2026-01-26T03:43:12","guid":{"rendered":"https:\/\/blog.gpst.net.cn:4008\/?p=306"},"modified":"2026-01-28T06:24:13","modified_gmt":"2026-01-28T06:24:13","slug":"bind%e8%bf%90%e7%bb%b4-docker-bind-9-20-16%e9%85%8d%e7%bd%aednssec","status":"publish","type":"post","link":"https:\/\/opshub.com.cn\/?p=306","title":{"rendered":"bind\u8fd0\u7ef4\u2014\u2014docker bind-9.20.16\u914d\u7f6ednssec"},"content":{"rendered":"\n
bind9-20251126.tar<\/a>Download<\/a><\/div>\n\n\n\n

Dockerfile\u7684\u4ee3\u7801\uff1a<\/p>\n\n\n\n

FROM alpine:latest as builder\nRUN sed -i 's|http.*\/alpine\/|https:\/\/mirrors.nju.edu.cn\/alpine\/|g' \/etc\/apk\/repositories && \\\n    apk add --no-cache build-base openssl-dev libuv-dev libcap-dev userspace-rcu-dev jemalloc-dev readline-dev json-c-dev nghttp2-dev zlib-dev perl\nWORKDIR \/usr\/local\/src\nCOPY .\/bind-9.20.16.tar.xz \/usr\/local\/src\nRUN tar -xJf bind-9.20.16.tar.xz && \\\n    cd bind-9.20.16 && \\\n    .\/configure --prefix=\/usr\/local\/bind9 \\\n    --sysconfdir=\/etc\/bind \\\n    --localstatedir=\/var\/bind \\\n    --enable-largefile \\\n    --enable-dnsrps \\\n    --with-openssl=yes \\\n    --with-readline=yes \\\n    --with-jemalloc \\\n    --with-json-c \\\n    --with-zlib && \\\n    make -j$(nproc) && \\\n    make install\nFROM alpine:latest\nRUN sed -i 's|http.*\/alpine\/|https:\/\/mirrors.nju.edu.cn\/alpine\/|g' \/etc\/apk\/repositories && \\\n    apk add --no-cache openssl-dev libuv-dev libcap-dev userspace-rcu-dev jemalloc-dev readline-dev json-c-dev nghttp2-dev zlib-dev perl\nRUN addgroup named && adduser -G named -S -D -H -h \/var\/bind -s \/sbin\/nologin named && \\\n    mkdir -p \/etc\/bind \/var\/bind && \\\n    chown -R named:named \/etc\/bind \/var\/bind\nCOPY --from=builder \/usr\/local\/bind9 \/usr\/local\/bind9\nWORKDIR \/etc\/bind\nCOPY .\/rndc.conf .\nCOPY .\/named.ca .\nENV PATH=\"\/usr\/local\/bind9\/sbin:\/usr\/local\/bind9\/bin:$PATH\"\nEXPOSE 53\/udp 53\/tcp\nCMD [\"named\", \"-g\", \"-u\", \"named\", \"-c\", \"\/etc\/bind\/named.conf\"]<\/code><\/pre>\n\n\n\n
\u751f\u6210named.ca\uff1a<\/p>\n\n\n\n
dig -t ns @a.root-servers.net. . >named.ca<\/code><\/pre>\n\n\n\n
rndc.conf\u7684\u4ee3\u7801\uff1a<\/p>\n\n\n\n
key \"rndc-key\" {\n\talgorithm hmac-sha256;\n\tsecret \"9we6RB9xNmgiC3Y16uS6fUjgpDIXWHHvRwKMY6AJmoM=\";\n};\noptions {\n\tdefault-key \"rndc-key\";\n\tdefault-server 127.0.0.1;\n\tdefault-port 953;\n};<\/code><\/pre>\n\n\n\n
\u6784\u5efaalpine-bind:9.20.16\u7684\u955c\u50cf\uff1a<\/p>\n\n\n\n
docker build --no-cache -t alpine-bind:9.20.16 .<\/code><\/pre>\n\n\n\n
named.conf\u7684\u4ee3\u7801\uff1a<\/p>\n\n\n\n
options {\n    directory \"\/var\/bind\";\n    pid-file \"\/var\/run\/named\/named.pid\";\n    listen-on port 53 { any; };\n    allow-query { any; };\n    allow-recursion { none; };\n    recursion no;\n};\nzone \".\" IN {\n    type hint;\n    file \"\/etc\/bind\/named.ca\";\n};\nzone \"example.com\" {\n    type primary;\n    file \"\/etc\/bind\/zones\/example.com.db\";\n    dnssec-policy default;\n};\nkey \"rndc-key\" {\n\talgorithm hmac-sha256;\n\tsecret \"9we6RB9xNmgiC3Y16uS6fUjgpDIXWHHvRwKMY6AJmoM=\";\n};\ncontrols {\n\tinet 127.0.0.1 port 953\n\t\tallow { 127.0.0.1; } keys { \"rndc-key\"; };\n};<\/code><\/pre>\n\n\n\n
zones\/example.com.db\u7684\u4ee3\u7801\uff1a<\/p>\n\n\n\n
$TTL 86400\n@ IN SOA ns1.example.com. yunhaoz000@gmail.com. (\n 1764126658\n 7200\n 3600\n 1209600\n 3600 )\n  IN NS ns1.example.com.\n  IN NS ns2.example.com.\nns1 1440 IN A 167.88.177.215\nns2 1440 IN A 167.88.177.215\nifconfig 205 IN A 222.94.76.5\nzyc 205 IN A 114.221.74.194\nkms.v0v 205 IN A 167.88.177.215\nkms.v3v IN CNAME ifconfig.example.com.\ncnta IN CNAME ifconfig.example.com.\ngofile IN CNAME ifconfig.example.com.\nsvn IN CNAME ifconfig.example.com.\nrelay-acting IN CNAME ifconfig.example.com.\ntime IN CNAME ifconfig.example.com.\nntp IN CNAME ifconfig.example.com.\nkms.v6v IN CNAME zyc.example.com.\ntun IN CNAME zyc.example.com.<\/code><\/pre>\n\n\n\n
docker-compose.yml\u7684\u4ee3\u7801\uff1a<\/p>\n\n\n\n
services:\n  memcached:\n    image: memcached:latest\n    container_name: memcached\n    ports:\n      - \"11211:11211\"\n    restart: always\n    command: memcached -m 64 -p 11211 -u memcache -l 0.0.0.0\n  bind9:\n    image: alpine-bind:9.20.16\n    container_name: bind9\n    ports:\n      - \"53:53\/udp\"\n    restart: always\n    volumes:\n      - .\/named.conf:\/etc\/bind\/named.conf:rw\n      - .\/zones:\/etc\/bind\/zones:rw<\/code><\/pre>\n\n\n\n
\u5bfc\u5165\u955c\u50cf:<\/p>\n\n\n\n
docker load -i alpine-bind_9.20.16.img.gz\ndocker load -i memcached_latest.img.gz<\/code><\/pre>\n\n\n\n
\u542f\u52a8\u5bb9\u5668\uff1a<\/p>\n\n\n\n
docker-compose up -d<\/code><\/pre>\n\n\n\n
\u83b7\u53d6DS\u8bb0\u5f55\uff1a<\/p>\n\n\n\n
docker exec -it bind9 dnssec-dsfromkey \/var\/bind\/Kexample.com.+013+52282.private\nexample.com. IN DS 52282 13 2 81D26780574037294C3A38FBFE563FD234D10B00297BCD7877851AC963634FFC<\/code><\/pre>\n\n\n\n
\u963f\u91cc\u4e91\u63a7\u5236\u53f0-\u57df\u540d\u4e0e\u7f51\u7ad9-\u57df\u540d\u5217\u8868-<\u57df\u540d>-\u7ba1\u7406-DNS\u7ba1\u7406-DNSSEC\u8bbe\u7f6e-\u6dfb\u52a0DS\u8bb0\u5f55\uff1a<\/p>\n\n\n\n
\u5bc6\u94a5\u6807\u7b7e\uff1a52282<\/p>\n\n\n\n
\u52a0\u5bc6\u7b97\u6cd5\uff1a13 ><\/p>\n\n\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u6458\u8981\u7c7b\u578b\uff1a2 ><\/p>\n\n\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u6458\u8981\uff1a<\/p>\n\n\n\n
81D26780574037294C3A38FBFE563FD234D10B00297BCD7877851AC963634FFC<\/p>\n\n\n\n
\u963f\u91cc\u4e91\u63a7\u5236\u53f0-\u57df\u540d\u4e0e\u7f51\u7ad9-\u57df\u540d\u5217\u8868-<\u57df\u540d>-\u7ba1\u7406-DNS\u7ba1\u7406-\u81ea\u5b9a\u4e49DNS Host-\u521b\u5efaDNS\u670d\u52a1\u5668\uff1a<\/p>\n\n\n\n
ns1.<\u57df\u540d> IP\u5730\u5740<\/p>\n\n\n\n
ns2.<\u57df\u540d> IP\u5730\u5740<\/p>\n\n\n\n
\u963f\u91cc\u4e91\u63a7\u5236\u53f0-\u57df\u540d\u4e0e\u7f51\u7ad9-\u57df\u540d\u5217\u8868-<\u57df\u540d>-\u7ba1\u7406-DNS\u7ba1\u7406-DNS\u4fee\u6539\uff1a<\/p>\n\n\n\n
\u4fee\u6539\u4e3a\u81ea\u5b9a\u4e49DNS\u670d\u52a1\u5668\uff1ans1.<\u57df\u540d> ns2.<\u57df\u540d><\/p>\n\n\n\n
DDNS\u8054\u52a8\u673a\u5236\uff1a<\/p>\n\n\n\n
\u5ba2\u6237\u7aef\u811a\u672cstoreipaddrtomemcache.sh\u7684\u4ee3\u7801\uff1a<\/p>\n\n\n\n
#!\/bin\/bash\nmem__key=\"ifconfig\"\nmem__ipaddr=\"167.88.177.215\"\nmem__port=\"11211\"\nipaddr=\"$(curl -4sLk -m 5 --retry 2 ip.sb\/ip 2>\/dev\/null | grep -Eo \"([0-9]{1,3}.){3}[0-9]{1,3}\")\"\nif [[ \"${#ipaddr}\" -gt \"0\" ]]; then\n\techo \"Your IP Address is: ${ipaddr}\"\n\techo \"Reading from Memcached ...\"\n\tipaddr__stored=\"$(printf \"get ${mem__key}\\r\\n\" | nc -w 1 ${mem__ipaddr} ${mem__port} | grep -Eo \"([0-9]{1,3}.){3}[0-9]{1,3}\")\"\n\tif [[ \"$ipaddr__stored\" != \"$ipaddr\" ]]; then\n\t\techo \"Sending to Memcached...\"\n\t\tprintf \"set ${mem__key} 0 900 ${#ipaddr}\\r\\n${ipaddr}\\r\\n\" | nc -w 2 ${mem__ipaddr} ${mem__port}\n\t\techo \"Done\"\n\telse\n\t\techo \"Already stored\"\n\tfi\nelse\n\techo \"Failed to get your IP Address\"\n\texit 1\nfi<\/code><\/pre>\n\n\n\n
\u670d\u52a1\u7aef\u811a\u672creadipaddrfrommemcache.sh\u7684\u4ee3\u7801\uff1a<\/p>\n\n\n\n
#!\/bin\/bash\nmem__keys=(ifconfig zyc)\nmem__ipaddr=\"167.88.177.215\"\nmem__port=\"11211\"\nzone__file=\"\/data\/bind9\/zones\/example.com.db\"\nif [[ ! -s \"$zone__file\" ]]; then\n\techo \"Zone file not found\"\n\texit 1\nfi\nupdated__tag=0\nfor ((i = 0; i < ${#mem__keys[@]}; i++)); do\n\tmem__key=\"${mem__keys[$i]}\"\n\tipaddr__stored=\"$(printf \"get ${mem__key}\\r\\n\" | nc -w 1 ${mem__ipaddr} ${mem__port} 2>\/dev\/null | grep -Eo \"([0-9]{1,3}.){3}[0-9]{1,3}\")\"\n\tif [[ \"${#ipaddr__stored}\" -gt \"0\" ]]; then\n\t\tipaddr__setted=\"$(awk '{if($1==K){print $0}}' K=$mem__key $zone__file | grep -Eo \"([0-9]{1,3}.){3}[0-9]{1,3}\")\"\n\t\tif [[ \"${#ipaddr__setted}\" -eq \"0\" ]]; then\n\t\t\techo \"Adding $mem__key ... ($ipaddr__stored)\"\n\t\t\techo \"${mem__key} 205 IN A ${ipaddr__stored}\" >>$zone__file\n\t\t\tlet updated__tag++\n\t\t\tcontinue\n\t\tfi\n\t\tif [[ \"$ipaddr__stored\" != \"$ipaddr__setted\" ]]; then\n\t\t\techo \"Updating $mem__key ... ($ipaddr__setted -> $ipaddr__stored)\"\n\t\t\tsed -i \"\/^${mem__key}\/s\/([0-9]{1,3}.){3}[0-9]{1,3}\/${ipaddr__stored}\/g\" $zone__file\n\t\t\tlet updated__tag++\n\t\telse\n\t\t\techo \"$mem__key Already updated ($ipaddr__stored)\"\n\t\tfi\n\tfi\ndone\nif [[ \"$updated__tag\" -gt \"0\" ]]; then\n\techo \"Updating zone file...\"\n\t\/bin\/cp -f $zone__file $zone__file.bak\n\tserial__num=\"$(date +%s)\"\n\tsed -i \"3s\/[0-9]+\/${serial__num}\/g\" $zone__file\n\tdocker exec -i bind9 named-checkzone example.com \/etc\/bind\/zones\/example.com.db &&\n\t\tdocker exec -i bind9 rndc reload\nfi<\/code><\/pre>\n\n\n\n
\u5ba2\u6237\u7aef\u811a\u672c\u8bbe\u7f6e\u4e3a1\u5206\u949f\u81ea\u52a8\u8fd0\u884c\u4e00\u6b21\uff0c\u5f53IP\u53d8\u5316\u540e\uff0c\u5c06\u5f53\u524d\u7684IP\u66f4\u65b0\u5230\u670d\u52a1\u7aef\u7684memcached\u7684\u76f8\u5173\u952e\u7684\u503c\u6682\u5b58900\u79d2\u3002<\/p>\n\n\n\n
\u670d\u52a1\u7aef\u811a\u672c\u8bbe\u7f6e\u4e3a1\u5206\u949f\u81ea\u52a8\u8fd0\u884c\u4e00\u6b21\uff0c\u5f53IP\u9700\u8981\u66f4\u65b0\u7684\u65f6\u5019\uff0c\u81ea\u52a8\u8fdb\u884cDNS\u8bb0\u5f55\u7684\u4fee\u6539\uff08\u65e0\u5219\u6dfb\u52a0\uff09\u5e76\u91cd\u8f7d\u6700\u65b0\u7684\u533a\u57df\u914d\u7f6e\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
Dockerfile\u7684\u4ee3\u7801\uff1a \u751f\u6210named.ca\uff1a rndc.conf\u7684\u4ee3\u7801\uff1a \u6784\u5efaalpine-bind:9.20.16\u7684\u955c\u50cf\uff1a named.conf\u7684\u4ee3\u7801\uff1a zones\/example.com.db\u7684\u4ee3\u7801\uff1a docker-compose.yml\u7684\u4ee3\u7801\uff1a \u5bfc\u5165\u955c\u50cf: \u542f\u52a8\u5bb9\u5668\uff1a \u83b7\u53d6DS\u8bb0\u5f55\uff1a \u963f\u91cc\u4e91\u63a7\u5236\u53f0-\u57df\u540d\u4e0e\u7f51\u7ad9-\u57df\u540d\u5217\u8868-<\u57df\u540d>-\u7ba1\u7406-DNS\u7ba1\u7406-DNSSEC\u8bbe\u7f6e-\u6dfb\u52a0DS\u8bb0\u5f55\uff1a \u5bc6\u94a5\u6807\u7b7e\uff1a52282 \u52a0\u5bc6\u7b97\u6cd5\uff1a13 > \u6458\u8981\u7c7b\u578b\uff1a2 > \u6458\u8981\uff1a 81D26780574037294C3A38FBFE563FD234D10B00297BCD7877851AC963634FFC \u963f\u91cc\u4e91\u63a7\u5236\u53f0-\u57df\u540d\u4e0e\u7f51\u7ad9-\u57df\u540d\u5217\u8868-<\u57df\u540d>-\u7ba1\u7406-DNS\u7ba1\u7406-\u81ea\u5b9a\u4e49DNS Host-\u521b\u5efaDNS\u670d\u52a1\u5668\uff1a ns1.<\u57df\u540d> IP\u5730\u5740 ns2.<\u57df\u540d> IP\u5730\u5740 \u963f\u91cc\u4e91\u63a7\u5236\u53f0-\u57df\u540d\u4e0e\u7f51\u7ad9-\u57df\u540d\u5217\u8868-<\u57df\u540d>-\u7ba1\u7406-DNS\u7ba1\u7406-DNS\u4fee\u6539\uff1a \u4fee\u6539\u4e3a\u81ea\u5b9a\u4e49DNS\u670d\u52a1\u5668\uff1ans1.<\u57df\u540d> ns2.<\u57df\u540d> DDNS\u8054\u52a8\u673a\u5236\uff1a \u5ba2\u6237\u7aef\u811a\u672cstoreipaddrtomemcache.sh\u7684\u4ee3\u7801\uff1a \u670d\u52a1\u7aef\u811a\u672creadipaddrfrommemcache.sh\u7684\u4ee3\u7801\uff1a \u5ba2\u6237\u7aef\u811a\u672c\u8bbe\u7f6e\u4e3a1\u5206\u949f\u81ea\u52a8\u8fd0\u884c\u4e00\u6b21\uff0c\u5f53IP\u53d8\u5316\u540e\uff0c\u5c06\u5f53\u524d\u7684IP\u66f4\u65b0\u5230\u670d\u52a1\u7aef\u7684memcached\u7684\u76f8\u5173\u952e\u7684\u503c\u6682\u5b58900\u79d2\u3002 \u670d\u52a1\u7aef\u811a\u672c\u8bbe\u7f6e\u4e3a1\u5206\u949f\u81ea\u52a8\u8fd0\u884c\u4e00\u6b21\uff0c\u5f53IP\u9700\u8981\u66f4\u65b0\u7684\u65f6\u5019\uff0c\u81ea\u52a8\u8fdb\u884cDNS\u8bb0\u5f55\u7684\u4fee\u6539\uff08\u65e0\u5219\u6dfb\u52a0\uff09\u5e76\u91cd\u8f7d\u6700\u65b0\u7684\u533a\u57df\u914d\u7f6e\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-306","post","type-post","status-publish","format-standard","hentry","category-dockerkubernetes"],"_links":{"self":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts\/306","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=306"}],"version-history":[{"count":5,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts\/306\/revisions"}],"predecessor-version":[{"id":627,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts\/306\/revisions\/627"}],"wp:attachment":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}