pub const DNS_CONTAINER_PORT: u16 = 5353;Expand description
DNS container port.
This is the port named binds inside the operand pod and the targetPort
of the DNS Service (which still exposes the standard DNS_PORT 53 to
clients). It is the unprivileged port 5353, so non-root named binds
it without the NET_BIND_SERVICE capability.
Cross-pod zone transfers stay coherent because bindcar (0.7.2+) accepts
port-qualified endpoints (<ip>:<port>): the operator publishes secondary
primaries and primary also-notify entries as <ip>:5353, and sets
NSUPDATE_PORT on the bindcar sidecar so dynamic updates target this port.
allow-transfer remains a bare-IP ACL (port-agnostic). See build_pod_spec,
render_listen_on, and crate::bind9::zone_ops.