Add dnsmasq split DNS and useful tools to Docker containers

Add dnsmasq to forward .fips queries to the FIPS daemon (port 5354)
and all other DNS to Docker's embedded resolver (127.0.0.11). Remove
the port 53 override from the node template so FIPS uses its default
port. Also add curl and python3 to the container image for testing.

examples/docker-network/Dockerfile

@@ -2,7 +2,8 @@ FROM debian:bookworm-slim
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-        iproute2 iputils-ping dnsutils openssh-client openssh-server iperf3 && \
+        iproute2 iputils-ping dnsutils openssh-client openssh-server iperf3 \
+        dnsmasq curl python3 && \
     rm -rf /var/lib/apt/lists/*
 
 # Setup SSH server with no authentication (test only!)
@@ -13,8 +14,18 @@ RUN mkdir -p /var/run/sshd && \
     sed -i 's/UsePAM yes/UsePAM no/' /etc/ssh/sshd_config && \
     passwd -d root
 
+# dnsmasq: forward .fips to FIPS daemon, everything else to Docker DNS
+RUN printf '%s\n' \
+    'port=53' \
+    'listen-address=127.0.0.1' \
+    'bind-interfaces' \
+    'server=/fips/127.0.0.1#5354' \
+    'server=127.0.0.11' \
+    'no-resolv' \
+    >> /etc/dnsmasq.conf
+
 COPY fips /usr/local/bin/
 RUN chmod +x /usr/local/bin/fips
 
-# Start SSH server and iperf3 server in background, then run FIPS
+# Start dnsmasq, SSH server, and iperf3 in background, then run FIPS
-ENTRYPOINT ["/bin/bash", "-c", "/usr/sbin/sshd && iperf3 -s -D && exec fips --config /etc/fips/fips.yaml"]
+ENTRYPOINT ["/bin/bash", "-c", "dnsmasq && /usr/sbin/sshd && iperf3 -s -D && exec fips --config /etc/fips/fips.yaml"]

examples/docker-network/configs/node.template.yaml

@@ -14,7 +14,6 @@ tun:
 dns:
   enabled: true
   bind_addr: "127.0.0.1"
-  port: 53
 
 transports:
   udp: