Dockerfile

FROM debian:trixie-slim AS builder

RUN apt-get update && apt-get install -y \
    curl \
    ca-certificates \
    build-essential \
    binutils \
    lld \
    pkg-config \
    upx-ucl \
    && rm -rf /var/lib/apt/lists/*

ENV RUSTUP_HOME=/usr/local/rustup \
    CARGO_HOME=/usr/local/cargo \
    PATH=/usr/local/cargo/bin:$PATH

RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable \
    && rustup default stable

WORKDIR /app

COPY . .

RUN cargo build --release
RUN upx --best --lzma ./target/release/dns-ingress

FROM debian:trixie-slim

RUN apt-get update && apt-get install -y \
    ca-certificates \
    curl \
    && rm -rf /var/lib/apt/lists/*

RUN useradd -m -u 1000 dns-ingress
COPY --from=builder /app/target/release/dns-ingress /usr/local/bin/dns-ingress

COPY config.toml.example /app/config.toml
WORKDIR /app
RUN chown -R dns-ingress:dns-ingress /app
USER dns-ingress
# Expose ports: DoT: 853, DoH: 443, DoQ: 853, DoH3: 443, Healthcheck: 8080
EXPOSE 853 443 8080
ENTRYPOINT ["/usr/local/bin/dns-ingress"]