公司目前有一套F5 DNS域名解析服务器，领导考虑还需要构建一套备份用的DNS进行域名解析进行冷备，但是因为考虑到成本问题，如果再买一套新的F5 DNS服务器成本太高，经过查询资料，考虑通过docker容器加bing9实现域名解析，以下步骤是整理后实现bind9+docker容器的方法
1.构建bind9镜像
首先准备两台服务器，保障可以正常访问外网，以便下载部署docker。
Docker 要求 CentOS 系统的内核版本高于 3.10 ，通过 uname -r 命令查看你当前的内核版本
$ uname -r
安装依赖包 ，yum-util 提供yum-config-manager功能，另外两个是devicemapper驱动依赖的
yum install -y yum-utils device-mapper-persistent-data lvm2
设置yum源
先备份一份：
cd /etc/yum.repos.d
cp CentOS-Base.repo CentOS-Base.repo.bak
# 替换阿里云镜像源
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
或者：
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
运行yum makecache生成缓存
运行yum update更新系统, 这个过程会比较慢
然后安装docker
yum install -y docker
启动docker
service docker start 或者systemctl start docker
设置docker开启自动启动
systemctl enable docker
因为服务器是开通的公网，所以直接进行搜索下载centos镜像
docker pull centos
#构建 启动一个centos7基础镜像容器，然后启动centos镜像，用于部署bind9做准备
docker run --name centos7 --privileged -ti -e "container=docker" -d -v /sys/fs/cgroup:/sys/fs/cgroup centos:7 /usr/sbin/init
规划 IP
bind9客户端 172.18.0.2
bind9服务端 172.18.0.3
在两个物理机上创建私有网络，默认为桥接网络
docker network create --subnet=172.18.0.0/24 private
2.# 配置容器初始化脚本，实现下载更新容器的centos版本，因为我的机器是需要配置代理进行公网访问，代理配置需要看个人服务器情况进行配置
mkdir -p ~/deploy/bind9
cat > ~/deploy/bind9/init.sh < #!/bin/bash sed -i "/proxy=/d" /etc/yum.conf echo "proxy=https://134.80.19.88:6001" >> /etc/yum.conf rm -f /etc/yum.repos.d/*.repo curl -x 134.80.19.88:6001 -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo curl -x 134.80.19.88:6001 -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo yum clean all; yum makecache fast yum -y update yum install -y bind which bind-utils cp /etc/named.conf /etc/named.conf.old cp /etc/sysconfig/named /etc/sysconfig/named.old EOF 3.# 复制上面的脚本到容器中并执行脚本内容升级容器centos版本 docker cp ~/deploy/bind9/init.sh centos7:/root/ docker exec -it centos7 sh -c "bash /root/init.sh" 4.配置DNS管理工具rndc，/etc/rndc.conf # 生成rndc默认配置数据（密钥、rndc服务地址等） docker exec -it centos7 bash -c "rndc-confgen" > ~/deploy/bind9/init-rndc.cnf # 移除无用的rndc.key docker exec -it centos7 bash -c "mv /etc/rndc.key /etc/rndc.key.nouse" # 创建bind9配置文件到宿主机映射目录 mkdir -p ~/deploy/bind9/conf # 拷贝rndc密钥到rndc.conf中 cat ~/deploy/bind9/init-rndc.cnf | grep -Pzo '^key "rndc-key" {\s*\n *.*;\s*\n *.*;\s*\n};' > ~/deploy/bind9/conf/rndc.conf echo >> ~/deploy/bind9/conf/rndc.conf cat ~/deploy/bind9/init-rndc.cnf | grep -Pzo '^options {\s*\n *.*;\s*\n *.*;\s*\n *.*;\s*\n};' >> ~/deploy/bind9/conf/rndc.conf # 修改rndc.conf中默认的rndc服务地址 perl -p -i -e 's/default-server .*/default-server 172.18.0.3;/g' ~/deploy/bind9/conf/rndc.conf 5. 配置/etc/named.conf # 拷贝容器中的原始named.conf到宿主机，更改文件属性为644，目的是不需要到容器内进行内容的更改，操作方便 docker cp centos7:/etc/named.conf ~/deploy/bind9/conf/named.conf chmod 644 ~/deploy/bind9/conf/named.conf # 获取named-parts.conf的行范围 start_line=`grep -n 'Use with the following in named.conf' ~/deploy/bind9/init-rndc.cnf | cut -d ':' -f 1` start_line=`expr $start_line + 1` end_line=`grep -n 'End of named.conf' ~/deploy/bind9/init-rndc.cnf | cut -d ':' -f 1` end_line=`expr $end_line - 1` # 提取named-parts.conf的行范围、反注释，导出到临时文件 sed -n "$start_line,$end_line p" init-rndc.cnf | sed 's/^# //g' > ~/deploy/bind9/named-parts.conf # 替换rndc监听地址为0.0.0.0 perl -p -i -e 's/inet .* port 953/inet 0.0.0.0 port 953/g' ~/deploy/bind9/named-parts.conf # 替换允许访问rndc的客户端地址 perl -p -i -e 's/allow.*;/allow { 127.0.0.1; 172.18.0.2; } keys { "rndc-key"; };/g' ~/deploy/bind9/named-parts.conf # 将上面修改的文件named-parts.conf 内容追加到named.conf cat ~/deploy/bind9/named-parts.conf >> ~/deploy/bind9/conf/named.conf # 修改named.conf监听地址为any（注意不是0.0.0.0） perl -p -i -e 's/listen-on port 53 { .*; };/listen-on port 53 { any; };/g' ~/deploy/bind9/conf/named.conf # 修改named.conf允许的客户端地址为any perl -p -i -e 's/allow-query *{ .*; };/allow-query { any; };/g' ~/deploy/bind9/conf/named.conf # 禁用dnssec，否则授权其他DNS解析时将会出错 perl -p -i -e 's/dnssec-enable *.*;/dnssec-enable no;/g' ~/deploy/bind9/conf/named.conf perl -p -i -e 's/dnssec-validation *.*;/dnssec-validation no;/g' ~/deploy/bind9/conf/named.conf # 在allow-query配置所在行后添加allow-new-zones sed -i '/allow-new-zones/d' ~/deploy/bind9/conf/named.conf sed -i '/allow-query *{ any; };/a\ allow-new-zones yes;' ~/deploy/bind9/conf/named.conf # 配置filter-aaaa-on-v4参数 sed -i '/filter-aaaa-on-v4/d' ~/deploy/bind9/conf/named.conf sed -i '/allow-new-zones *.*;/a\ filter-aaaa-on-v4 yes;' ~/deploy/bind9/conf/named.conf # 配置二级DNS授权解析，可以通过其他解析地址进行解析 sed -i '/forward/d' ~/deploy/bind9/conf/named.conf sed -i '/filter-aaaa-on-v4 *.*;/a\ forward only;' ~/deploy/bind9/conf/named.conf sed -i '/forward only;/a\ forwarders { 10.17.253.11; };' ~/deploy/bind9/conf/named.conf # 删除所有^M换行符 perl -p -i -e 's/\r//g' ~/deploy/bind9/conf/named.conf # 配置日志 # 删除原有日志定义（不可重入） start_line=`grep -n 'logging {' ~/deploy/bind9/conf/named.conf | cut -d ':' -f 1 | head -1` end_line=`expr $start_line + 6` sed -i "$start_line,$end_line d" ~/deploy/bind9/conf/named.conf echo >> ~/deploy/bind9/conf/named.conf cat >> ~/deploy/bind9/conf/named.conf <
logging { channel bind.log { file "/var/lib/bind/bind.log" versions 10 size 20m; severity debug; print-category yes; print-severity yes; print-time yes; }; category queries { bind.log; }; category default { bind.log; }; category config { bind.log; }; }; ! # 创建日志文件 mkdir -p ~/deploy/bind9/logs touch ~/deploy/bind9/logs/bind.log chmod 646 ~/deploy/bind9/logs/bind.log 6.配置/etc/sysconfig/named # 拷贝原始容器中的named配置文件到宿主机 docker cp centos7:/etc/sysconfig/named ~/deploy/bind9/conf/named # 添加named文件仅解析IPv4配置 sed -i '/^OPTIONS=/d' ~/deploy/bind9/conf/named echo 'OPTIONS="-4"' >> ~/deploy/bind9/conf/named 7.复制容器内的zone文件到宿主机，可通过配置zone文件的域名进行解析 docker cp centos7:/var/named ~/deploy/bind9/zone chmod -R 647 ~/deploy/bind9/zone 8. 提交bind容器 # 删除同名镜像 docker rmi bind:9.11 # 提交一个bind9的基础镜像 docker commit centos7 bind:9.11 # 销毁centos7容器 docker kill centos7; docker rm centos7 9. bind9服务端容器的启动 # 基于私有网络创建一个固定IP的bind9服务端容器 docker run --name bind9-srv --net private --ip 172.18.0.3 -p 53:53/udp --privileged -ti -e "container=docker" -d -v /sys/fs/cgroup:/sys/fs/cgroup -v /root/deploy/bind9/conf/named.conf:/etc/named.conf -v /root/deploy/bind9/conf/rndc.conf:/etc/rndc.conf -v /root/deploy/bind9/conf/named:/etc/sysconfig/named -v /root/deploy/bind9/zone:/var/named -v /root/deploy/bind9/logs/bind.log:/var/lib/bind/bind.log bind:9.11 /usr/sbin/init # 启动服务端的bind9容器 docker exec -it bind9-srv sh -c "systemctl enable named --now" docker exec -it bind9-srv sh -c "systemctl status named -l" 10. bind9客户端容器的启动 # 基于私有网络创建一个固定IP的bind9客户端容器 docker run --name bind9-clnt --net private --ip 172.18.0.2 --privileged -ti -e "container=docker" -d -v /sys/fs/cgroup:/sys/fs/cgroup -v /root/deploy/bind9/conf/rndc.conf:/etc/rndc.conf bind:9.11 /usr/sbin/init # 测试rndc连接，查看是否可以正常进行连接私有网络 docker exec -it bind9-clnt sh -c "rndc -c /etc/rndc.conf -s 172.18.0.3 -p 953 status" # 测试创建一个zone文件的域名配置，然后查看是否可以进行域名解析 cat > ~/deploy/bind9/zone/sword.cn.zone <
\$TTL 86400 @ IN SOA 123.sword.cn. root.sword.cn. ( 2015042313;Serial 3H;Refresh 15M;Retry 1W;Expire 1D;Minimum ); IN NS 123.sword.cn. 123 IN A 192.168.1.9 456 IN A 192.168.1.10 789 IN A 192.168.1.11 ! 更改现在的配置文件的属性，要不然不能进行正常的域名解析 chmod 755 sword.cn.zone 通过rndc 将zone域名配置写入到容器的服务端 docker exec -it bind9-clnt sh -c "rndc -s 172.18.0.3 -p 953 addzone sword.cn '{ type master; file \"sword.cn.zone\"; };'" # 测试已配置的zone是否可以进行域名解析 docker exec -it bind9-clnt sh -c "nslookup 123.sword.cn 172.18.0.3" # 测试授权的域名是否可以进行解析 docker exec -it bind9-clnt sh -c "nslookup bass.sdboss.com 172.18.0.3" 以上就是通过构建bind9+docker容器实现的域名解析步骤~