Dockerfile

FROM gcr.io/distroless/static-debian12:nonroot

ARG TARGETPLATFORM
ARG VERSION=dev
ARG REVISION=unknown
ARG CREATED=unknown

LABEL org.opencontainers.image.title="Sable" \
      org.opencontainers.image.description="Modern, high-performance DNS server" \
      org.opencontainers.image.source="https://github.com/drudge/sable" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.revision="${REVISION}" \
      org.opencontainers.image.created="${CREATED}"

COPY --chown=nonroot:nonroot ${TARGETPLATFORM}/sable /usr/local/bin/sable
COPY --chown=nonroot:nonroot docker/data/ /data/

WORKDIR /data
VOLUME ["/data"]

# DNS is deliberately unprivileged inside the container. Publish it as host
# port 53 with -p 53:8053/tcp -p 53:8053/udp.
EXPOSE 8053/tcp 8053/udp 5380/tcp 5443/tcp 853/tcp 443/tcp

USER nonroot:nonroot
# The immutable launcher normally behaves exactly like the Sable command. When
# SABLE_WEB_UPDATES=true it can hand off to a newer, non-root executable stored
# in /data without exposing the Docker socket or any host privileges.
ENTRYPOINT ["/usr/local/bin/sable", "container"]
CMD ["serve", "--config", "/data/sable.toml"]