{"project":{"id":"01a0ea3d-6c85-4ac0-ac46-0cdca3b4e787","name":"unbound","repository":"git@github.com:antilax-3/docker-unbound.git","description":"Unbound is a validating, recursive, caching DNS resolver in a container.","default_branch":"master","json_path":"/antilax-3/unbound.json","path":"/antilax-3/unbound","settings_path":"/antilax-3/unbound/settings","builds_path":"https://buildkite.com/antilax-3/unbound/builds","builds_count":17,"scheduled_builds_path":"/antilax-3/unbound/builds?state=scheduled","scheduled_builds_count":0,"running_builds_path":"/antilax-3/unbound/builds?state=running","running_builds_count":0,"permissions":{"edit":{"allowed":false,"reason":"anonymous","message":"You must be signed in to change this pipeline"},"trigger_build":{"allowed":false,"reason":"anonymous","message":"You must be signed in to trigger a build in this pipeline"},"favorite_project":{"allowed":false,"reason":"anonymous","message":"You must be signed in to favorite this pipeline"}}},"pipelineSettings":null,"builds":[{"id":"01a0f777-6f72-4155-96f2-7e992d8eabd1","number":17,"message":"docs: restyle badges with shieldcn (#9) Replace the badges with shieldcn ones in the style of docker-smartexporter: outline badges in a centred row, each a picture with a dark and a light variant. The row carries the Buildkite build, and the image size and pulls of the wolfi image. The repo publishes neither releases nor version tags, and carries no licence, so there is no version or licence badge. The microbadger badges are dropped, as microbadger has shut down, along with the old shields.io pulls and stars badges. The logo is centred above the badges and taken from the AntilaX-3 GitHub avatar. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/antilax-3/unbound/builds/17","commit_id":"b3747baa0640fd6dc1ead7b5545b3a1e857ad5ff","commit_short_length":7,"commit_url":"https://github.com/antilax-3/docker-unbound/commit/b3747baa0640fd6dc1ead7b5545b3a1e857ad5ff","author_name":"Amir Zarrinkafsh","author_avatar":"https://buildkiteusercontent.com/assets/7eb28a38-066b-418b-95c5-b5c7fb78c6bc/3339418.jpg","branch_name":"master","branch_path":"/antilax-3/unbound/builds?branch=master","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-10-01T12:36:34.807Z","scheduled_at":"2026-10-01T12:36:34.838Z","started_at":"2026-10-01T12:36:35.695Z","canceled_at":null,"finished_at":"2026-10-01T12:50:56.260Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":null,"merge_queue_path":"/antilax-3/unbound/builds"},{"id":"01a0eb03-c291-49ce-8e79-760dcc9cf5d5","number":11,"message":"refactor(s6-overlay): register the services in user-bundles.d (#5) * refactor(s6-overlay): register the services in user-bundles.d s6-overlay 3.2 deprecates defining the user bundle under /etc/s6-overlay/s6-rc.d and warns on every start. Register the unbound and unboundsetup services in /etc/s6-overlay/user-bundles.d/user/contents.d instead, where the base image already registers adduser, so the bundles merge into one. The service definitions, and their dependencies on adduser and on each other, are unchanged. The image test now asserts the container starts without a deprecation warning, which fails against the image before this change. After it, every path outside the bundle directories has the same mode, owner and type as before, and the image passes the full suite, with unboundsetup still seeding /config before unbound starts as abc. * refactor: exclude the repository tooling from the build context The dockerignore listed a READMETEMPLATE.md and a .github directory that do not exist, and none of the files added during the port. Exclude the pipeline, the lint and renovate configs and the IDE directory instead, matching the base images. The Dockerfile copies only root/, so the image is unchanged; the context sent to the builder simply stops carrying files nothing reads. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/antilax-3/unbound/builds/11","commit_id":"d8389a9a52f04d0336c593480c18232db0f2daa4","commit_short_length":7,"commit_url":"https://github.com/antilax-3/docker-unbound/commit/d8389a9a52f04d0336c593480c18232db0f2daa4","author_name":"Amir Zarrinkafsh","author_avatar":"https://buildkiteusercontent.com/assets/7eb28a38-066b-418b-95c5-b5c7fb78c6bc/3339418.jpg","branch_name":"master","branch_path":"/antilax-3/unbound/builds?branch=master","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-09-29T02:34:47.323Z","scheduled_at":"2026-09-29T02:34:47.360Z","started_at":"2026-09-29T02:34:48.282Z","canceled_at":null,"finished_at":"2026-09-29T02:40:27.783Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":null,"merge_queue_path":"/antilax-3/unbound/builds"},{"id":"01a0eb29-c1d3-43eb-90c1-93338c0623f2","number":13,"message":"feat: build on wolfi and move alpine to its own tag (#6) * feat: build multi-arch images for amd64 and arm64 Add arm64 to the platforms the pipeline builds and tests. The build stage already cross-compiles unbound on the build platform against a sysroot of the target's packages and picks its toolchain triple from TARGETARCH, and the pipeline already generates one test step per platform, so the only change is the platform list itself. qemu is left running the final stage's apk add and unbound-anchor alone, and an arm64 build takes about as long as an amd64 one. armv7 is left out. antilax3/alpine is built for it, but antilax3/wolfi, which the image is moving to, is not, because wolfi publishes amd64 and arm64 only, and the pipeline builds every variant for the same platforms. The arm64 image reports the aarch64 apk architecture and the arm64 machine in unbound's elf header, every library unbound links resolves, and it passes the full suite under emulation, resolving and validating through the root servers as abc. * feat: build on wolfi and move alpine to its own tag Build the image twice from one Dockerfile, once on antilax3/wolfi and once on antilax3/alpine, and make wolfi the default. The wolfi build takes the unsuffixed tags, so latest, 1, 1.26 and 1.26.1 now come from it, and the alpine build takes alpine, 1-alpine, 1.26-alpine and 1.26.1-alpine, following the convention docker-library uses for variants. Branch, pull request and build tags gain the same suffix, and the tag cleanup already matches the suffixed forms, so a deleted branch or a closed pull request removes both of its tags. The base image arrives as a build arg, so unbound keeps exactly one version definition and renovate has one place to bump. The build stage picks everything else off the libc it finds. Alpine ships gnupg under that name with its keyserver client, the c library headers in musl-dev, and protoc as a dependency of protobuf-c-compiler. Wolfi names the gnupg package gpg, splits its keyserver client into gnupg-dirmngr, ships the headers in glibc-dev and packages protoc separately. Wolfi also merges /usr/sbin into /usr/bin, so unbound installs into /usr/bin there, since a linked copy into /usr/sbin would replace that symlink rather than write through it; /usr/sbin/unbound still resolves on both. The runtime libraries already follow the build as so: dependencies, which picks this up without a second list: wolfi's hiredis is a different soname to alpine's and resolves to its own package. Both variants compile the same release from the same verified tarball with the same modules and dnstap, so the choice between them is only the base. The wolfi image is 72MB against alpine's 38MB on amd64, the difference being glibc, bind-tools' larger dependency tree and the larger wolfi base. Wolfi ships no ldd, so the image test lists each binary's libraries through the dynamic loader instead, which both libcs support, and which reports a library deleted from either image. It asserts the base, the libc and the build packages per variant, except nghttp2-dev on wolfi, which wolfi's bind-libs declares as a runtime dependency, so dig pulls it in whatever this image does. The readme documents the tags. Both variants were built for amd64 and arm64 and pass the full suite: unbound 1.26.1 built for the right machine with every library resolved, running as abc, validating a signed zone and rejecting a broken one, the trust anchor seeded into /config and an older config migrated, s6 starting without deprecation warnings, and no build packages or artefacts left behind. * ci(buildkite): give each variant its own deployment concurrency group Every variant's build and deploy step on master shared one concurrency group, so the wolfi and alpine images queued behind each other rather than building in parallel. Suffix the group with the variant, as docker-ipmiexporter and docker-baseimage-node now do, so each variant only waits on an earlier master build of itself while different variants deploy concurrently. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/antilax-3/unbound/builds/13","commit_id":"fc1dc2f820306faa5ac7e401f5b56df8fe352424","commit_short_length":7,"commit_url":"https://github.com/antilax-3/docker-unbound/commit/fc1dc2f820306faa5ac7e401f5b56df8fe352424","author_name":"Amir Zarrinkafsh","author_avatar":"https://buildkiteusercontent.com/assets/7eb28a38-066b-418b-95c5-b5c7fb78c6bc/3339418.jpg","branch_name":"master","branch_path":"/antilax-3/unbound/builds?branch=master","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-09-29T03:16:17.498Z","scheduled_at":"2026-09-29T03:16:17.530Z","started_at":"2026-09-29T03:16:18.384Z","canceled_at":null,"finished_at":"2026-09-29T03:31:11.247Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":null,"merge_queue_path":"/antilax-3/unbound/builds"},{"id":"01a0eaf9-9432-450a-89e4-188791042ce6","number":9,"message":"ci: add renovate for unbound (#4) Add a renovate config following the conventions in the base images, extending config:recommended with semantic commits typed build for every update, so the subjects it writes are lowercase, under 72 characters and inside the build type and deps scope the commit-msg hook already accepts. Annotate the UNBOUND_VERSION build arg so a regex manager picks it up. Unbound resolves through its GitHub releases, which are tagged release-.., so a package rule takes the version out of the tag. Its release candidates are tagged but never published as releases, so the releases datasource only ever proposes final releases, and the rule's pattern would reject an rc suffix regardless. The annotation names the dependency unbound and passes the repository as a separate packageName, keeping NLnetLabs/unbound out of the commit subject. A lookup dry-run against the current tree extracts unbound at 1.26.1 with no update. With the pin wound back to 1.25.2 the same lookup proposes 1.26.1 as a minor update on renovate/unbound-1.x, which the tag sanitiser publishes as renovate-unbound-1.x, and the subject renovate writes for it passes the commit-msg hook. Renovate skips antilax3/alpine because latest is unversioned, which is the intent, and finds nothing to propose for the docker/dockerfile syntax, which already tracks its major version. Document how unbound is bumped in the readme. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/antilax-3/unbound/builds/9","commit_id":"4d851a6ca9e8c0b93328eea8600b5436e48fa27b","commit_short_length":7,"commit_url":"https://github.com/antilax-3/docker-unbound/commit/4d851a6ca9e8c0b93328eea8600b5436e48fa27b","author_name":"Amir Zarrinkafsh","author_avatar":"https://buildkiteusercontent.com/assets/7eb28a38-066b-418b-95c5-b5c7fb78c6bc/3339418.jpg","branch_name":"master","branch_path":"/antilax-3/unbound/builds?branch=master","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-09-29T02:23:40.087Z","scheduled_at":"2026-09-29T02:23:40.116Z","started_at":"2026-09-29T02:23:41.063Z","canceled_at":null,"finished_at":"2026-09-29T02:29:20.568Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":null,"merge_queue_path":"/antilax-3/unbound/builds"},{"id":"01a0f26e-0125-4090-a7ff-f8ddf552b593","number":15,"message":"ci(buildkite): keep build tags with any variant suffix (#8) The tag cleanup after a master build kept BK tags only with a suffix naming one of master's own variants. A branch adding a variant pushes BK- tags master doesn't know yet, so a master build running alongside it deletes them as stale branch tags while the branch's test steps are pulling them. docker-smartexporter lost BK10-alpine this way while adding its alpine variant. Keep BK tags, and the version tags, with any lowercase suffix. PR tags, branch tags and the bare variant tags are matched as before. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/antilax-3/unbound/builds/15","commit_id":"2b7e9ac40739518aa0551b7f94d5dd4e56e4e9d2","commit_short_length":7,"commit_url":"https://github.com/antilax-3/docker-unbound/commit/2b7e9ac40739518aa0551b7f94d5dd4e56e4e9d2","author_name":"Amir Zarrinkafsh","author_avatar":"https://buildkiteusercontent.com/assets/7eb28a38-066b-418b-95c5-b5c7fb78c6bc/3339418.jpg","branch_name":"master","branch_path":"/antilax-3/unbound/builds?branch=master","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-09-30T13:08:10.668Z","scheduled_at":"2026-09-30T13:08:10.698Z","started_at":"2026-09-30T13:08:11.562Z","canceled_at":null,"finished_at":"2026-09-30T13:23:01.198Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":null,"merge_queue_path":"/antilax-3/unbound/builds"}]}