feat: add lightweight Alpine Unbound DNS container

- Multi-arch support (x86_64 and ARM64)
- ~50MB image size vs ~500MB for Ubuntu version
- DNSSEC validation with root hints
- Health checks and resource limits
- Security hardening (hide identity/version, harden-glue, etc.)
- Build script for easy single/multi-arch builds

builds/alpine-unbound/docker-compose.yml

@@ -0,0 +1,42 @@
+version: "3.9"
+
+services:
+  alpine-unbound:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: alpine-unbound:latest
+    container_name: alpine_unbound
+    restart: unless-stopped
+    environment:
+      - TZ=America/New_York
+    volumes:
+      - unbound_config:/etc/unbound/unbound.conf.d
+      - unbound_data:/var/lib/unbound
+    ports:
+      - "5335:5335/tcp"
+      - "5335:5335/udp"
+    networks:
+      - dns_net
+    healthcheck:
+      test: [ "CMD", "/usr/local/bin/healthcheck.sh" ]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 5s
+    deploy:
+      resources:
+        limits:
+          memory: 128M
+        reservations:
+          memory: 32M
+
+networks:
+  dns_net:
+    driver: bridge
+
+volumes:
+  unbound_config:
+    driver: local
+  unbound_data:
+    driver: local