devzwf/pihole-dot-doh

By devzwf

Updated 7 days ago

Official pihole docker both DoT (DNS over TLS) , DoH (DNS over HTTPS) and unbound.

Image
Networking
Security
5

100K+

devzwf/pihole-dot-doh repository overview

pihole-dot-doh

Official pihole docker with both DoT (DNS over TLS) and DoH (DNS over HTTPS) clients. Don't browse the web securely and yet still send your DNS queries in plain text!

Upgrade Notes

Caution

!!! THE LATEST VERSION CONTAINS BREAKING CHANGES

Pi-hole v6 has been entirely redesigned from the ground up and contains many breaking changes.

Environment variable names have changed, script locations may have changed.

If you are using volumes to persist your configuration, be careful.
Replacing any v5 image (2024.07.0 and earlier) with a v6 image will result in updated configuration files. These changes are irreversible.

Please read the README carefully before proceeding.

https://docs.pi-hole.net/docker/

V6 - Newest Version

Usage:

For docker parameters, refer to official pihole docker readme. Below is an docker compose example.

services:
  pihole:
    container_name: pihole
    image: devzwf/pihole-dot-doh:latest
    ports:
      # DNS Ports
      - "53:53/tcp"
      - "53:53/udp"
      # Default HTTP Port
      - "80:80/tcp"
      # Default HTTPs Port. FTL will generate a self-signed certificate
      - "443:443/tcp"
      # Uncomment the below if using Pi-hole as your DHCP Server
      #- "67:67/udp"
    environment:
      # Set the appropriate timezone for your location (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones), e.g:
      TZ: 'America/Toronto'
      # Set a password to access the web interface. Not setting one will result in a random password being assigned
      FTLCONF_webserver_api_password: '<WEB_PASSWORD>'
      FTLCONF_dns_upstreams: '127.1.1.1#5153;127.0.0.1#5335'
      FTLCONF_dns_listeningMode: 'all'
    # Volumes store your data between container upgrades
    volumes:
      # For persisting Pi-hole's databases and common configuration file
      - './piholev6/etc-pihole:/etc/pihole'
      - './piholev6/config/:/config'
      - './piholev6/log:/var/log
      # Uncomment the below if you have custom dnsmasq config files that you want to persist. Not needed for most.
      #- './piholev6/etc-dnsmasq.d:/etc/dnsmasq.d'
      
    #cap_add:
      # See https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
      # Required if you are using Pi-hole as your DHCP server, else not needed
      #- NET_ADMIN
      #- CAP_SYS_NICE
    restart: unless-stopped

V5 - Old and not maintain anymore (2024.07.0)

Usage:

For docker parameters, refer to official pihole docker readme. Below is an docker compose example.

services:
  pihole:
    container_name: pihole-dot-doh
    image: devzwf/pihole-dot-doh:2024.07.0
    hostname: pihole1
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "67:67/udp"
      - "82:80/tcp"
    environment:
      TZ: 'America/Toronto'
      #WEBPASSWORD: 'password'
      PIHOLE_DNS_: '127.1.1.1#5153;127.2.2.2#5253'
      #INTERFACE: 'br0'
      FTLCONF_LOCAL_IPV4: '<IP of the docker host>'
      FTLCONF_LOCAL_IPV6: ''
      IPv6: 'False'
      DNSMASQ_LISTENING: 'all'
      # Use boxed layout (helpful when working on large screens)
      #WEBUI BOXED LAYOUT: 'boxed'
    # Volumes store your data between container upgrades
    volumes:
      - './pihole/:/etc/pihole/'
      - './dnsmasq.d/:/etc/dnsmasq.d/'
      - './config/:/config'
      - './log/pihole/:/var/log/pihole
      #Unbound Log if you need it
      #- './log/unbound/:/var/log/unbound
    cap_add:
      - NET_ADMIN
    restart: unless-stopped
Notes:
  • Remember to set pihole env PIHOLE_DNS_ to use the DoH / DoT / Unbound IP below. If PIHOLE_DNS_ is NOT set, Pihole will use a non-encrypted service.
    • DoH service (dnscrypt-proxy) runs at 127.1.1.1#5153. Uses Cloudflare Security (1.1.1.2 ) by default
    • DoT service (stubby) runs at 127.2.2.2#5253. Uses google (8.8.8.8 / 8.8.4.4) by default (removed for now)
    • Unbound service run at 127.0.0.1#5335
  • In addition to the 2 official paths, you can also map container /config to expose configuration files for dnscrypt-proxy (dnscrypt-proxy.toml) and stubby (stubby.yml).
    • Edit these files to add / remove services as you wish. The flexibility is yours.
  • Credits:

Support

ko-fi

Tag summary

Content type

Image

Digest

sha256:7ec28b7ff

Size

62 MB

Last updated

7 days ago

docker pull devzwf/pihole-dot-doh:2026.07.2-z00