yonder00/dnscrypt-proxy repository overview

⁠🛡️ dnscrypt-proxy Docker Image

A tiny, multi-architecture dnscrypt-proxy⁠ container that auto-generates its config on first run, and then stays out of your way so you can manage it manually.

⁠✨ Features

• Multi-arch builds: linux/amd64, linux/arm64, linux/arm/v7
• Weekly automated builds with latest dnscrypt-proxy release
• Small image Multi stage build (~6MB compressed)
• Preserves official config comments — you edit /config/dnscrypt-proxy.toml directly
• Never overwrites your changes after first run

⁠🏷 Tagging

This image uses:

:latest — always the most recent weekly build :- — semantic version from upstream plus build date

Example: 2.1.12-20250810 for dnscrypt-proxy 2.1.12, built 10th August 2025

⁠🔄 Build & Update Schedule

Build trigger: Every Sunday via GitHub Actions

Source: Pulls the latest release tarballs directly from the dnscrypt-proxy GitHub releases

Publish: Multi-platform images pushed to Docker Hub

⁠🚀 Quick start (docker-compose)

version: "3.9"
services:
  dnscrypt-proxy:
    image: yourdockerhubuser/dnscrypt-proxy:latest
    container_name: dnscrypt-proxy
    restart: unless-stopped
    # Map UDP port 53 on the host to the container
    ports:
      - "53:53/udp"
    environment:
      # Optional: file ownership for /config on first run
      PUID: "1000"
      PGID: "1000"
    volumes:
      - ./config:/config

⁠docker run example

docker run -d \
  --name=dnscrypt-proxy \
  --restart unless-stopped \
  -p 53:53/udp \
  -v $(pwd)/config:/config \
  yonder00/dnscrypt-proxy:latest

⁠🛠 Editing Configuration

After the first container start, edit ./config/dnscrypt-proxy.toml directly on the host.

nano ./config/dnscrypt-proxy.toml

⁠📦 Volumes

Path inside container Description /config dnscrypt-proxy configuration dir

⁠📋 Healthcheck

This container has an integrated healthcheck that runs every 30 seconds, querying cloudflare.com against itself to ensure resolution is working.

⁠🔒 Security Considerations

This container listens on port 53/udp by default.

If running on a public server, firewall it so only trusted clients can query it.

DNS over TCP is not enabled by default — if you enable it in your config, remember to also expose 53/tcp.

⁠⚖️ License

dnscrypt-proxy: ISC license⁠