# Pi-hole runs on podman

**URL:** <https://discourse.pi-hole.net/t/pi-hole-runs-on-podman/34719>\
**Category:** docker\
**Tags:** v5-0\
**Created:** [June 22, 2020, 12:05am UTC](https://discourse.pi-hole.net/t/pi-hole-runs-on-podman/34719 "2020-06-22T00:05:20Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Metta\_Crawler](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/metta_crawler/32/1959_2.png) [@Metta\_Crawler](https://discourse.pi-hole.net/u/Metta_Crawler)\
**Post date:** [June 22, 2020, 12:05am UTC](https://discourse.pi-hole.net/t/pi-hole-runs-on-podman/34719/1 "2020-06-22T00:05:20Z")

</div>

Hi

I managed to get pi-hole running in [podman](https://podman.io/) today. I don't think it will work with podman less than version 2.0.0 and [podman-compose](https://github.com/containers/podman-compose/) less than 0.1.7dev. This is way I'm using today:

```auto
$ podman-compose version
using podman version: podman version 2.0.0
podman-composer version 0.1.7dev
podman --version
podman version 2.0.0

$ uname -rsvm
Linux 5.7.2-2-ARCH #1 SMP Tue Jun 16 12:48:51 UTC 2020 aarch64

```

The lighttpd fails to start with the example `docker-compose.yml` file on the [docker hub page for pihole](https://hub.docker.com/r/pihole/pihole)

```auto
sudo: getrlimit: Operation not permitted
[...skip ahead...]
2020-06-21 19:30:49: (server.c.970) couldn't get 'max filedescriptors' Operation not permitted 
Stopping lighttpd

```

Adding `privileged: true` to the `docker-compose.yml` appears to be one way to get lighttpd to start. This [issue was reported by docker users](https://github.com/pi-hole/docker-pi-hole/issues/593) so it does not appear to be specific to podman.

I think that there should be a way to make it work with fewer added capabilities than the set which is added when `--privileged` is used but I have not figured out which one are needed. I tried adding just `--cap-add SYS_RESOURCE` but that wasn't enough.

Does anyone have the minimum set of capabilities required to get the container to start?

---

<div class="post-metadata">

**Author:** ![o4flouo8t2ih](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/o/2bfe46/32.png) [@o4flouo8t2ih](https://discourse.pi-hole.net/u/o4flouo8t2ih)\
**Post date:** [August 16, 2020, 11:05pm UTC](https://discourse.pi-hole.net/t/pi-hole-runs-on-podman/34719/2 "2020-08-16T23:05:16Z")

</div>

**DISCLAIMER: On my system (which is acting as the lan gateway), this opens port 53 and port 80 to the public despite my firewalld configuration blocking all external connections. Please don't use this configuration in production!**

I was able to get pihole running with podman and systemd with the following service unit in `/etc/systemd/system/pihole.service`:

```auto
[Unit]
Description=Podman pihole.service
Documentation=man:podman-generate-systemd(1)
Wants=network.target
After=network-online.target

[Service]
Type=simple
User=root
Environment=PODMAN_SYSTEMD_UNIT=%n
EnvironmentFile=/etc/sysconfig/pihole
ExecStartPre=/bin/rm -f %t/container-pihole.pid %t/container-pihole.ctr-id
ExecStart=/usr/bin/podman run --env-file=/etc/sysconfig/pihole --pull=always --cidfile %t/container-pihole.ctr-id --cgroups=no-conmon --replace --name pihole -p ${PIFACE}:53:53/tcp -p ${PIFACE}:53:53/udp -p ${PIFACE}:80:80 -p ${PIFACE}:443:443 -v /etc/pihole/:/etc/pihole/:z -v /etc/pihole/dnsmasq.d/:/etc/dnsmasq.d/:z --dns=127.0.0.1 --dns=9.9.9.9 --hostname ${HOSTNAME} docker.io/pihole/pihole:latest
TimeoutStartSec=30s
TimeoutStopSec=30s
ExecStopPost=/usr/bin/podman rm --ignore -f --cidfile %t/container-pihole.ctr-id
#CapabilityBoundingSet=SYS_RESOURCE NET_ADMIN # this didn't work for me

[Install]
WantedBy=multi-user.target default.target

```

And my environment file in `/etc/sysconfig/pihole` (replace pi.hole with your hostname and change the password ofc):

```auto
TZ=America/New_York
WEBPASSWORD=password123
DNS1=8.8.8.8
DNS2=9.9.9.9
DNSSEC=rue
HOSTNAME=pi.hole
VIRTUAL_HOST=pi.hole
PROXY_LOCATION=pi.hole
ServerIP=192.168.1.1
PIFACE=192.168.1.1

```

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [August 16, 2020, 11:42pm UTC](https://discourse.pi-hole.net/t/pi-hole-runs-on-podman/34719/3 "2020-08-16T23:42:44Z")

</div>

Are any capabilities needed for DHCP server options?

Edit: Oh, this is running as `root`, not as `podman` without `root`?

---

<div class="post-metadata">

**Author:** ![o4flouo8t2ih](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/o/2bfe46/32.png) [@o4flouo8t2ih](https://discourse.pi-hole.net/u/o4flouo8t2ih)\
**Post date:** [August 17, 2020, 5:22am UTC](https://discourse.pi-hole.net/t/pi-hole-runs-on-podman/34719/4 "2020-08-17T05:22:38Z")

</div>

Yeah, it's running as root. I haven't ventured into rootless territory yet. If you do that then for one, you will have to bind to ports higher than 1024. There's likely to be other problems too.

Also, big disclaimer, I have no idea how its happening, but when I run this service, it appears to open ports 80 and 53 on the host despite my external firewall zone explicitly blocking everything. I verified this with a public port scanning tool that those ports were open. When I stop the pihole service, the port scanner shows nothing, so it's definitely pihole. Thus, I can't recommend the above configuration until I figure out why that's happening.

---

<div class="post-metadata">

**Author:** ![o4flouo8t2ih](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/o/2bfe46/32.png) [@o4flouo8t2ih](https://discourse.pi-hole.net/u/o4flouo8t2ih)\
**Post date:** [August 18, 2020, 5:49pm UTC](https://discourse.pi-hole.net/t/pi-hole-runs-on-podman/34719/5 "2020-08-18T17:49:00Z")

</div>

Got some help from reddit on this one. The issue is that doing -p 53:53 binds to all interfaces. If I specify just the local interface (127.0.0.1), then it won't expose the port externally. Will update the code above accordingly (adding PIFACE environment variable to sysconfig file).

---

<div class="post-metadata">

**Author:** ![Metta\_Crawler](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/metta_crawler/32/1959_2.png) [@Metta\_Crawler](https://discourse.pi-hole.net/u/Metta_Crawler)\
**Post date:** [September 23, 2020, 12:55am UTC](https://discourse.pi-hole.net/t/pi-hole-runs-on-podman/34719/6 "2020-09-23T00:55:08Z")

</div>

For

> <https://github.com/pi-hole/docker-pi-hole/issues/593>
>
> This is a... 
> 
> \- \[\] Request for a new or modified feature
> \- \[\] Issue trying… to run the docker image
> \- \[\] Issue trying to build / test / develop the docker image
> 
> \## Description
> I want Install PiHole and RainLoop as Docker
> 
> \## Expected Behavior
> I Install fresh Raspian, activatet SSH and Install Docker.
> And install Pihole "docker pull pihole/pihole"
> 
> \## Actual Behavior
> Its hanging "Starting lighttpd"
> 
> \## Steps to Reproduce and debugging done
> 
> e.g. your docker run command, pages to visit, CLI commands you ran
> 1. Install Docker
> 2. Install PiHole: docker pull pihole/pihole
> 3. Its hanging "Starting lighttpd"
> 
> \## Debug steps I have tried
> docker rm pihole (=Error: No such container: pihole)
> docker rmi pihole/pihole (=Error response from daemon: conflict: unable to remove repository reference "pihole/pihole" (must force) - container f2ec19c0a213 is using its referenced image 96082728873a)
> 
> \- \[\] I have tried destroying my container instance, pulling the newest image version, and re-creating a new container
> \- \[\] I have tried running the nearly stock \`docker run\` example in the readme (removing any customizations I added)
> \- \[\] I have tried running without my volume data mounts to eliminate volumes as the cause
> \- \[\] I have searched this repository for existing issues and pull requests that look similar 
> 
> \## Your Environment 
> 
> \* Docker Host Operating System and OS Version: Raspian on Raspberry Pi 3
> \* Docker Version: 19.03.8
> \* Hardware architecture: Raspberry Pi

This issue was solved. The root cause is major bugs in seccomp (libseccomp) on 64-bit ARM ( aarch64) prior to seccomp version 2.4.3.

[https://github.com/seccomp/libseccomp/pull/235](https://github.com/seccomp/libseccomp/pull/235)

---

<div class="post-metadata">

**Author:** ![andrewm659](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/439d5e/32.png) [@andrewm659](https://discourse.pi-hole.net/u/andrewm659)\
**Post date:** [March 16, 2021, 4:29pm UTC](https://discourse.pi-hole.net/t/pi-hole-runs-on-podman/34719/7 "2021-03-16T16:29:40Z")

</div>

Did you ever get this fixed?

---

<div class="post-metadata">

**Author:** ![Metta\_Crawler](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/metta_crawler/32/1959_2.png) [@Metta\_Crawler](https://discourse.pi-hole.net/u/Metta_Crawler)\
**Post date:** [March 20, 2021, 9:52pm UTC](https://discourse.pi-hole.net/t/pi-hole-runs-on-podman/34719/8 "2021-03-20T21:52:28Z")

</div>

> Yeah, it's running as root. I haven't ventured into rootless territory yet. If you do that then for one, you will have to bind to ports higher than 1024.

False.

To allow non-root to open ports 53, 67, 80 and 443:

`$ sudo sh -c "echo 52 > /proc/sys/net/ipv4/ip_unprivileged_port_start"`

---

<div class="post-metadata">

**Author:** ![Metta\_Crawler](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/metta_crawler/32/1959_2.png) [@Metta\_Crawler](https://discourse.pi-hole.net/u/Metta_Crawler)\
**Post date:** [March 20, 2021, 9:58pm UTC](https://discourse.pi-hole.net/t/pi-hole-runs-on-podman/34719/9 "2021-03-20T21:58:38Z")

</div>

If you want to see how it works look at the github page

> <https://github.com/pi-hole/docker-pi-hole/issues/593>
>
> This is a... 
> 
> \- \[\] Request for a new or modified feature
> \- \[\] Issue trying… to run the docker image
> \- \[\] Issue trying to build / test / develop the docker image
> 
> \## Description
> I want Install PiHole and RainLoop as Docker
> 
> \## Expected Behavior
> I Install fresh Raspian, activatet SSH and Install Docker.
> And install Pihole "docker pull pihole/pihole"
> 
> \## Actual Behavior
> Its hanging "Starting lighttpd"
> 
> \## Steps to Reproduce and debugging done
> 
> e.g. your docker run command, pages to visit, CLI commands you ran
> 1. Install Docker
> 2. Install PiHole: docker pull pihole/pihole
> 3. Its hanging "Starting lighttpd"
> 
> \## Debug steps I have tried
> docker rm pihole (=Error: No such container: pihole)
> docker rmi pihole/pihole (=Error response from daemon: conflict: unable to remove repository reference "pihole/pihole" (must force) - container f2ec19c0a213 is using its referenced image 96082728873a)
> 
> \- \[\] I have tried destroying my container instance, pulling the newest image version, and re-creating a new container
> \- \[\] I have tried running the nearly stock \`docker run\` example in the readme (removing any customizations I added)
> \- \[\] I have tried running without my volume data mounts to eliminate volumes as the cause
> \- \[\] I have searched this repository for existing issues and pull requests that look similar 
> 
> \## Your Environment 
> 
> \* Docker Host Operating System and OS Version: Raspian on Raspberry Pi 3
> \* Docker Version: 19.03.8
> \* Hardware architecture: Raspberry Pi

---

<div class="post-metadata">

**Author:** ![andrewm659](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/439d5e/32.png) [@andrewm659](https://discourse.pi-hole.net/u/andrewm659)\
**Post date:** [April 2, 2021, 3:52pm UTC](https://discourse.pi-hole.net/t/pi-hole-runs-on-podman/34719/10 "2021-04-02T15:52:41Z")

</div>

I'd rather run this as rootfull. I want it to have it's OWN IP address.