TL;DR — Quick Summary

A step-by-step tutorial on securing your home network by deploying Pi-hole as a DNS sinkhole via Docker containerization.

Blocking advertisements across every single device in your house—including Smart TVs and IoT vacuums—is the Holy Grail of home networking. Pi-hole accomplishes this by acting as a “DNS Sinkhole.”

In this guide, we will effortlessly deploy a highly available Pi-hole instance using Docker Compose.

Step 1: The Port 53 Warning (Ubuntu Users)

Pi-hole is a DNS Server, meaning it strictly requires Port 53. Unfortunately, modern Ubuntu distributions ship with a native service (systemd-resolved) that permanently hogs port 53. We must free it up first.

Open the systemd config:

sudo nano /etc/systemd/resolved.conf

Uncomment and change the line to:

DNSStubListener=no

Save the file, then apply the changes:

sudo systemctl restart systemd-resolved

Step 2: Prepare the Directory

Create a stable landing zone for our persistent DNS data blocks.

mkdir -p /opt/pihole
cd /opt/pihole

Step 3: Write the Configuration

Inside your /opt/pihole folder, create a docker-compose.yml file:

version: "3"

services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "80:80/tcp"
    environment:
      TZ: 'America/New_York'
      WEBPASSWORD: 'SuperSecretPassword'
    volumes:
      - './etc-pihole:/etc/pihole'
      - './etc-dnsmasq.d:/etc/dnsmasq.d'
    restart: unless-stopped

Important: Change the TZ to your exact timezone and set a strong WEBPASSWORD. You will use this password to access the Web UI.

Step 4: Fire up the Sinkhole

Deploy your application stack:

docker-compose up -d

Give it exactly 60 seconds to download the massive ad-blocking blocklists from GitHub. Once it stabilizes, you can access the beautiful admin interface at: http://<YOUR_LINUX_SERVER_IP>/admin

Step 5: Route Your Entire House Through Pi-hole

Right now, Pi-hole is sitting idle. To actually block ads, devices must ask Pi-hole “where is this website?” instead of asking Google or your ISP.

  1. Log into your physical home router (e.g., Netgear, Asus, Unifi).
  2. Look for the LAN / DHCP Server settings.
  3. Find the DNS Server settings.
  4. Replace the existing DNS IP with the Static IP Address of your Linux server hosting Docker.

Renew the DHCP lease on your phone by toggling Wi-Fi off and on. Congratulations! Every device is now cryptographically shielded against telemetry and tracking domains.