Dockerized Pi-Hole container without -net=host
Quick notes on Pi-Hole in a docker container. This thing is so good, I actually subscribed and gave them real money!
1) Download and run the container with a pull command.
a) docker pull pihole/pihole:4.1_armhf
b) the "docker run" command shown has a couple of differences to the official documentation.
Essentially the ports needed for DHCP can't work as documentated as far as I can work out. From what I can understand, the clients broadcast a request on a network segment to get an IP address from the DHCP server. Unfortunately the docker containers are all, in effect, on a different segment to the host's physical interfaces. i.e. they will never hear the broadcast requests.
This is why many people use the --net=host setting. With this docker option the container is directly connected to the host's IP stack. The downside of doing that is it cuts-off the possibility of other containers using those ports, which is not good in a router/filewall. The configuration here will allow for running other container's like a VPN client, a http VPN proxy server, a VPN server etc concurrently on the same pi.
See below for a cure to the broadcast issue. For now, however, note that the container's port 67 is not "published" so as to free it up.
note: computers on the local LAN have been named so as to add them to the container's internal /etc/hosts file via docker's startup mechanism. In --net=host scenario docker will simply copy the entire host's /etc/hosts file in to the container and use that. Hence the requirement for --add-host entries.
note: Port 53 tcp is problematic if you intend to use dnscrypt. See the dnscrypt page for details.
#!/bin/bash
docker run -d \
-e ServerIP="192.168.0.254" \
-e ServerIPv6="" \
-p 192.168.0.254:53:53/tcp \
-p 192.168.0.254:53:53/udp \
-p 192.168.0.254:80:80 \
-p 192.168.0.254:443:443 \
-v /docker/pihole/data/pihole/:/etc/pihole/ \
-v /docker/pihole/data/dnsmasq.d/:/etc/dnsmasq.d/ \
--add-host printer:192.168.0.2 \
--add-host printer.localdomain:192.168.0.2 \
--add-host mac:192.168.0.3 \
--add-host mac.localdomain:192.168.0.3 \
--add-host eee:192.168.0.4 \
--add-host eee.localdomain:192.168.0.4 \
--add-host playstation:192.168.0.5 \
--add-host playstation.localdomain:192.168.0.5 \
--add-host rpi1panasonic:192.168.0.6 \
--add-host rpi1panasonic.localdomain:192.168.0.6 \
--add-host tvheadend:192.168.0.7 \
--add-host tvheadend.localdomain:192.168.0.7 \
--add-host registry:192.168.0.8 \
--add-host registry.localdomain:192.168.0.8 \
--add-host ps4:192.168.0.9 \
--add-host ps4.localdomain:192.168.0.9 \
--add-host san00:192.168.0.10 \
--add-host san00.localdomain:192.168.0.10 \
--add-host poweranalyzer:192.168.0.11 \
--add-host poweranalyzer.localdomain:192.168.0.11 \
--name pihole \
--restart unless-stopped \
--cap-add NET_ADMIN \
--dns 127.0.0.1 \
--dns 1.1.1.1 \
docker.io/pihole/pihole:latest
# --net=host \
2) Enable the DHCP server in docker container's Pi-Hole settings
3) Install dhcrelay on the host with "dnf install dhcrelay". Note: all pi machines here use Fedora, so RPMs should exist on Centos, RHEL, and derivates.
4) It is essential to use the ID and IU interface specifications in the dhcrelay setup. This tells dhcrelay to listen for broadcasts on one interface and relay to another:
a) cp -a /lib/systemd/system/dhcrelay.service /etc/systemd/system/
b) vi /etc/systemd/system/dhcrelay.service
c) ExecStart=/usr/sbin/dhcrelay -d --no-pid -id eth0 -iu docker0 172.17.0.2
5) Change the dnsmasq options to include:
a) dhcp-option=option:dns-server,192.168.0.254
without this pihole adds the container's address (172.17.0.2) to dhcp's DNS server list ahead of the host's address. This is bad since nobody on the LAN can access 172.17.0.2 and so causes clients to timeout before using PiHole's LAN DNS address (which is the host's interface - 192.168.0.254 in this case).
System diagram
Computers on the Docker0 network are docker container "Machine Images", while computers on eth0 are actual machines (most of the Pi's are also running docker with yet more containers). Eth1 is a USB ethernet adaptor which provides the router/firewall hardware support.
Testing (from the Fedora desktop machine):
1) To release the lease address use: dhclient -v -r eno1
2) To renew a lease use: dhclient -v eno1
3) cat /etc/resolv.conf