Sign inSign up

edelux/dns-proxy

By edelux

•Updated 4 days ago

Local DNS resolver using DoH for privacy, in a tiny container and support for cloud and local infra.

Image
Networking
Security
Operating systems
0

2.9K

edelux/dns-proxy repository overview

⁠edelux/dns-proxy

A secure, minimal DNS resolver container with DNS-over-HTTPS (DoH), caching, and split DNS — ideal for cloud and local infrastructure.

⁠🐧 About

edelux/dns-proxy is a lightweight container built from Debian Stable⁠ and designed for high-security, low-footprint DNS resolution.

This image combines dnscrypt-proxy⁠ and dnsmasq⁠ to provide:

  • DNS-over-HTTPS (DoH) and DNSCrypt v2 secure upstreams
  • Anonymized DNSCrypt and Oblivious DoH (ODoH) support
  • Caching resolver using dnsmasq
  • Split DNS: forward selected domains to traditional DNS servers
  • Non-root execution using nobody user
  • Built image from scratch for minimal footprint
  • Based on Debian packages unpacked with dpkg -x during build (no apt install needed at runtime)

⁠🚀 Quick Start

Run the container with default ports and custom parameters:

docker run --rm -p 53:53/udp -d edelux/dns-proxy

docker run --rm -p 53:53/udp -d edelux/dns-proxy \
  --anonymized \
  --server=/ec2.internal/10.18.0.2 \
  --server=/amazonaws.com/10.18.0.2

This configuration enables:

  • DNS queries to DoH providers via anonymizing relays
  • Split DNS resolution for AWS internal domains via plain DNS (recommended for cloud infra)

⁠⚙️ Configuration via Parameters

Configuration is handled at runtime using command-line flags:

FlagDescription
--server=Specifies a plain DNS server (e.g. --server=/amazonaws.com/10.18.0.2). Recommended for internal or cloud-specific domains.
--doh-server=Defines the secure DoH or DNSCrypt v2 server. Supports DNSCrypt, DoH, Anonymized DNSCrypt, and ODoH.
--doh-route=Specifies which anonymized resolver to use when querying DoH providers.
--nocacheDisables all DNS caching. Useful for debugging or environments where caching is not desirable.
--cachesize=Sets the maximum number of DNS entries to cache. Set to 0 to disable caching entirely.
--anonymizedEnables anonymized routing of DoH queries using relay resolvers.

All parameters are optional and can be combined freely.

⁠📦 Architecture Support
  • amd64
  • arm64
  • riscv64
  • ppc64le
  • s390x
⁠✅ Use Cases
  • Lightweight encrypted DNS proxy for secure-by-default setups
  • Internal DNS resolver for cloud environments (e.g. AWS, GCP)
  • Drop-in replacement for public resolvers in private infrastructure
  • Self-hosted DNS gateway for IoT, edge, or containerized environments
⁠🔐 Security & Footprint
  • Runs as unprivileged user (nobody)
  • Uses only statically unpacked system files
  • No package manager, cron, or extra services
  • No unnecessary binaries or language runtimes
⁠🛠 Build Philosophy
  • Based on Debian packages
  • Runtime built from scratch
  • Uses dpkg -x to extract only required files
  • No runtime apt install or package manager
  • Focused on minimalism, clarity, and reproducibility
⁠📎 Links

GitHub Repository⁠

⁠✨ License

This project is released under the MIT⁠

⁠🔁 Repository Renaming Notice

This project was formerly published as:

Support for new images will continue under the new name edelux/dns-proxy. The previous image and repository will remain available but will only mirror updates made to this project until December 31, 2025.

Tag summary

Content type

Image

Digest

sha256:1af0aa7b5…

Size

27.5 MB

Last updated

4 days ago

docker pull edelux/dns-proxy