CoreDNS v1.14.2 build recipe

github.com/coredns/coredns (v1.14.2) at dd1df4f5db93767a44e37638df44969503b320d2

Fetched once, with the network on, by the vendor step (Dockerfile.vendor) when the kit was made; the offline build uses the kit's vendored copies:

• git https://github.com/coredns/coredns.git v1.14.2
• https://github.com/canonical/chisel/releases/download/v1.5.1/chisel_v1.5.1_linux_amd64.tar.gz
• https://github.com/canonical/chisel-releases/archive/f2600d3aa90123db6d44bb1441a99afc8b5847d9.tar.gz

• Base imagegolang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af
• Base imageubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852
• BuildKitmoby/buildkit:v0.31.2
  sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0
• Build methodsource-rebuild-go
• SOURCE_DATE_EPOCH1772772585 (2026-03-06T04:49:45Z)
• Target digest (linux/amd64)sha256:faf5d9691f306d7f318377a2db731aa843ef8ed23866e7c410cdbc001dda2c4b
• Target config digestsha256:4ad64d3f76e714057d267c146ab893eac110364c942d37a8eb7e5932adc0449c
• Checksummed kit files10,207 (CHECKSUMS.sha256)

# =====================================================================
# CoreDNS v1.14.2 L-009 HERMETIC OFFLINE BUILD: the canonical, attestation-producing build. build_kit runs
#   docker buildx build --builder readystack-builder-max --network=none
#     --attest type=provenance,mode=max,version=v1 --attest type=sbom --push <directory context>
# Pinned-public-base + vendored model: golang 1.26.10 and ubuntu 24.04 pinned BY DIGEST (BASE_IMAGE_DIGESTS.lock);
# vendored/coredns-src is the fully vendored Go tree (GOPROXY=off, -mod=vendor); vendored/chisel the chiselled Ubuntu
# 24.04 runtime (gen_dockerfile.py's runtime_base cut); vendored/debs libcap2-bin for setcap in the rootfs stage only.
# Dockerfile and Dockerfile.offline are byte copies of this file (the repo-wide convention).
#
# SHAPE: upstream's image (coredns/coredns Dockerfile at v1.14.2: distroless static, /coredns with
# `setcap cap_net_bind_service=+ep`, USER nonroot:nonroot = 65532, WORKDIR /, ENTRYPOINT ["/coredns"]) on a chiselled Ubuntu 24.04
# runtime instead of distroless. The file capability lets the non-root user bind :53 under kubeadm v1.36.6's CoreDNS
# Deployment (capabilities add NET_BIND_SERVICE, drop ALL; allowPrivilegeEscalation false; readOnlyRootFilesystem):
# with no_new_privs a file capability is still honoured when the process already holds it in its permitted set, which
# the runtime grants from the Pod's add list.
# =====================================================================

# --- CoreDNS v1.14.2 (Makefile: CGO off, coremain.GitCommit stamp; plugin.cfg's generated zplugin.go/zdirectives.go are
#     committed at the tag) -------------------------------------------------------------------------------------------
FROM golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af AS build_coredns
WORKDIR /coredns
COPY vendored/coredns-src/ .
ENV CGO_ENABLED=0 GOTOOLCHAIN=local GOWORK=off GOFLAGS="-mod=vendor -buildvcs=false" GOPROXY=off
RUN mkdir -p /out && go build -trimpath -ldflags "-s -w -X github.com/coredns/coredns/coremain.GitCommit=dd1df4f" -o /out/coredns . && \

Continues: 59 more lines. Create a free account to read the rest, or sign in.

#!/usr/bin/env bash
# =============================================================================
# ReadyStack — offline reproducible rebuild.
#
# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access
# of any kind, and prints the resulting linux/amd64 image-manifest digest.
# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.
#
# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.
# No git, no registry access, no additional tooling.
#
#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)
#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI
#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,
#                                     isolated build platform and sign that provenance with a key the build cannot
#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image
#                                     digest is the same either way.
# =============================================================================
set -euo pipefail
PROVENANCE=0
for arg in "$@"; do
  case "$arg" in
    --provenance) PROVENANCE=1 ;;
    -h|--help) sed -n '2,20p' "$0"; exit 0 ;;

Continues: 101 more lines. Create a free account to read the rest, or sign in.