INFRA Signal 124
Custom hardened container image for PowerDNS Recursor reduces attack surface and dependencies
↗
A custom-built container image for PowerDNS Recursor replaces the official Debian-based image with a minimal static build and runtime hardening measures
This approach demonstrates how to reduce container attack surfaces by eliminating unnecessary dependencies, restricting syscalls, and enforcing least-privilege runtime constraints. For engineers deploying critical infrastructure, it highlights trade-offs between security and maintainability when deviating from official images. The work also surfaces gaps in default container configurations that may require manual hardening for production use
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The custom image shrinks from 355 MB to 36 MB by using static compilation and a scratch base instead of Debian
Landlock and seccomp restrict filesystem access, network ports, and syscalls to only what the application requires
Runtime hardening includes read-only filesystems, noexec tmpfs, dropped capabilities, and no-new-privileges security options
THE READ
What the cluster adds up to.
The custom container image replaces the official PowerDNS Recursor image with a minimal static build. The official image uses Debian as a base, which includes thousands of files and hundreds of megabytes of dependencies. By compiling the application with Musl and copying only the executables to a scratch image, the custom image reduces the footprint by an order of magnitude. This eliminates attack surfaces from unused system tools and libraries, but requires manual verification of the build process and dependencies
Runtime hardening measures restrict the container's access to the host system. Landlock is used to sandbox filesystem and network access, limiting read/write paths and TCP/UDP ports to those explicitly required by the application. Seccomp further restricts syscalls to an allowlist generated through strace and testing. These measures prevent attackers from exploiting unnecessary system access, but require kernel support and may break functionality if the allowlist is incomplete or the application evolves
The container runtime configuration enforces least-privilege principles. The image runs with read-only filesystems, a noexec tmpfs for temporary files, and all Linux capabilities dropped. IPC is disabled, and the no-new-privileges security option prevents privilege escalation. These constraints reduce the impact of potential vulnerabilities, but may require adjustments for applications with different runtime requirements. The configuration also includes sysctls to allow binding to privileged ports as a non-root user
The hardening approach introduces trade-offs between security and maintainability. The custom image is rebuilt daily to track the latest stable PowerDNS releases, ensuring dependency updates are applied. However, this requires maintaining a separate build pipeline and CI system. Features like SNMP and URL-based zone caching are excluded to avoid dependencies with historical CVEs, which may limit functionality for some users. The hardening measures also generate less noise in vulnerability scanners, but may require additional testing to ensure compatibility across architectures and kernels
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER