Build or embed a DNS server to filter allowed external hostnames

[Joongi Kim]

It is non-trivial to manage outbound security rules using IP addresses, as many external websites rely on load balancers and volatile IP addresses on top of clouds.

Let's build a DNS server that provides transparent access to whitelist domains (e.g., github.com) from user kernel sessions but returns "unresolved" results for other domains.
This would not be perfect but will provides a good starting point.

[Joongi Kim]

I've found a way to do this: http://www.teknynja.com/2009/06/to-protect-and-surf-dnsmasq-and.html

dnsmasq.conf:

domain-needed
bogus-priv
no-resolv

server=/google.com/172.31.0.2
server=/github.com/172.31.0.2
...

Above config on an Ubuntu container can be tested with dig google.com @127.0.0.1 after installing/configuring dnsmasq package.

NOTE: When run inside docker, we need to add one more line to its config: user=root to avoid "dnsmasq: setting capabilities failed: Operation not permitted" error.

We could let Docker use our custom dnsmasq server.