Repeated segmentation faults in a Pi-hole Docker container running on a Raspberry Pi 3 (Model B Rev 1.2, ARM64) with DietPi

Expected Behaviour

Pi-hole running in Docker on my Raspberry Pi 3 Model B Rev 1.2 (64-bit DietPi) should complete pihole -g (gravity update) and rebuild the gravity database without segmentation faults. The DNS service should start cleanly and stay operational.


Operating System

  • OS: DietPi (Debian Bookworm 12 aarch64)
  • Kernel:
    Linux DietPi 6.12.47+rpt-rpi-v8 #1 SMP PREEMPT Debian 1:6.12.47-1+rpt1~bookworm (2025-09-16) aarch64
    
  • Filesystem: ext4
  • libseccomp2: 2.5.4-1+deb12u1

Hardware

Raspberry Pi 3 Model B Rev 1.2 (ARM Cortex-A53 × 4, 64-bit)


Docker Engine Version

Client: Docker Engine - Community
 Version:           28.5.1
 API version:       1.51
 Go version:        go1.24.8
 Git commit:        e180ab8
 OS/Arch:           linux/arm64

Server: Docker Engine - Community
 Engine:
  Version:          28.5.1
  API version:      1.51 (minimum 1.24)
  Go version:       go1.24.8
  Git commit:       f8215cc
  OS/Arch:          linux/arm64
 containerd:
  Version:          v1.7.28
 runc:
  Version:          1.3.0
 docker-init:
  Version:          0.19.0

Docker Run Command

docker run -d --name pihole \
  -p 53:53/tcp -p 53:53/udp \
  -p 80:80/tcp -p 443:443/tcp \
  -e TZ=America/Regina \
  -e FTLCONF_webserver_api_password='[REDACTED]' \
  -e FTLCONF_dns_listeningMode='all' \
  -v /srv/pihole/etc-pihole:/etc/pihole \
  -v /srv/pihole/etc-dnsmasq.d:/etc/dnsmasq.d \
  --restart unless-stopped \
  pihole/pihole:latest

Bind Mounts

  • /srv/pihole/etc-pihole/etc/pihole
  • /srv/pihole/etc-dnsmasq.d/etc/dnsmasq.d
  • Host ownership: chown -R 999:999 /srv/pihole/etc-* (UID 999 = pihole user inside container)

Actual Behaviour

Segmentation faults appear almost immediately after container start.
Excerpt from docker logs pihole:

[i] Setting up user & group for the pihole user
[i] PIHOLE_UID not set in environment, using default ()
[i] PIHOLE_GID not set in environment, using default ()

[i] Starting FTL configuration
/usr/bin/bash_functions.sh: line 128:    11 Segmentation fault      (core dumped) chown pihole:pihole /macvendor.db
[i] No DNS upstream set in environment or config file, defaulting to Google DNS
[i] Assigning password defined by Environment Variable
[i] Starting crond for scheduled scripts. Randomizing times for gravity and update checker
[i] Ensuring logrotate script exists in /etc/pihole
/usr/bin/bash_functions.sh: line 94:    20 Segmentation fault      (core dumped) install -Dm644 -t /etc/pihole /etc/.pihole/advanced/Templates/logrotate
[i] Gravity migration checks
[i] No adlist file found, creating one with a default blocklist
[i] /etc/pihole/gravity.db does not exist (Likely due to a fresh volume)
[i] Gravity will now be run to create the database
Gravity temporary directory does not exist or is not a writeable directory, falling back to /tmp.
/opt/pihole/gravity.sh: line 343:    32 Segmentation fault      (core dumped) timeout 4 getent hosts "${lookupDomain}" &> /dev/null
[✗] DNS resolution is currently unavailable
[✓] DNS resolution is available
/opt/pihole/gravity.sh: line 1019:    34 Segmentation fault      (core dumped) mkdir -p "${listsCacheDir}"
/opt/pihole/gravity.sh: line 1019:    35 Segmentation fault      (core dumped) mv "${piholeDir}"/list.* "${listsCacheDir}/" 2> /dev/null
[✗] Migrating the list's cache directory to new location
[i] Creating new gravity database
/opt/pihole/gravity.sh: line 67:    39 Segmentation fault      (core dumped) chown pihole:pihole "${1}"
/opt/pihole/gravity.sh: line 67:    40 Segmentation fault      (core dumped) chmod 664 "${1}"
/opt/pihole/gravity.sh: line 67:    42 Segmentation fault      (core dumped) chmod g+w "$(dirname -- "${1}")"
[✗] Error creating new gravity database. Please contact support.
[✗] Unable to migrate to database. Please contact support.
[i] pihole-FTL pre-start checks
Segmentation fault (core dumped)
Segmentation fault (core dumped)
dnsmasq: cannot open log /var/log/pihole/pihole.log: Permission denied

Container then floods logs with repeated Segmentation fault (core dumped) messages.


What I’ve Tried

  1. Verified ext4 filesystem and correct permissions (UID 999).
  2. Rebuilt container using bind mounts instead of named volumes.
  3. Confirmed libseccomp ≥ 2.5 and Docker 28.5.1.
  4. Tested with --security-opt seccomp=unconfined; no improvement.

Usually the default user is 1000, not 999.

Are you sure 999 is used inside the container?

This looks like a permission issue:

dnsmasq: cannot open log /var/log/pihole/pihole.log: Permission denied

Follow-up with targeted tests (as per ChatGPT) on Raspberry Pi 3 Model B Rev 1.2 (DietPi Bookworm, aarch64), Docker 28.5.1.

  1. Show image entrypoint/CMD:
    $ docker image inspect pihole/pihole:latest
    → Returns JSON as expected (no crash).

  2. Bypass entrypoint, run id(1) directly:
    $ docker run --rm --platform linux/arm64 --entrypoint /usr/bin/id pihole/pihole:latest pihole
    → No output returned

  3. Bypass entrypoint, open bash and run coreutils:
    $ docker run --rm -it --platform linux/arm64 --entrypoint /bin/bash pihole/pihole:latest -lc 'uname -a; id; id pihole; ls -ld /var/log/pihole || true'
    → All segfault: uname/id/ls each “Segmentation fault (core dumped)”.

Control test on same host:
$ docker run --rm -it --platform linux/arm64 debian:bookworm bash -lc 'uname -a; id; mkdir /tmp/t && chown 999:999 /tmp/t && echo OK'
→ Works normally

I'm wondering if this is an incompatibility on RPi3?

No.

Many user have Pi-hole container running on a Pi3. I had until 10 days ago an instance running on a Pi3B+, but unfortunately it is not available today.

As a test, I executed a similar command in a Pi4B and it works:

docker run --rm -it --entrypoint /bin/bash pihole/pihole:latest -lc 'uname -a; id; id pihole; ls -ld /var/log/pihole || true'

Linux ce44b5630064 5.10.103-v7l+ #1529 SMP Tue Mar 8 12:24:00 GMT 2022 armv7l GNU/Linux
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
uid=1000(pihole) gid=1000(pihole) groups=1000(pihole),1000(pihole)
drwxr-xr-x 1 root root 4096 Oct 28 17:11 /var/log/pihole

Did you try to include these environment variables to your docker run command:

  -e PIHOLE_UID=999 \
  -e PIHOLE_GID=999 \

docker logs pihole
[i] Setting up user & group for the pihole user
[i] Changing ID for user: pihole ( => 999)
[i] Changing ID for group: pihole ( => 999)

[i] Starting FTL configuration
/usr/bin/bash_functions.sh: line 128: 12 Segmentation fault (core dumped) chown pihole:pihole /macvendor.db
[i] Password already set in config file
[i] Starting crond for scheduled scripts. Randomizing times for gravity and update checker

[i] Ensuring logrotate script exists in /etc/pihole
/usr/bin/bash_functions.sh: line 94: 20 Segmentation fault (core dumped) install -Dm644 -t /etc/pihole /etc/.pihole/advanced/Templates/logrotate

[i] Gravity migration checks
[i] /etc/pihole/gravity.db does not exist (Likely due to a fresh volume). This is a required file for Pi-hole to operate.
[i] Gravity will now be run to create the database
Gravity temporary directory does not exist or is not a writeable directory, falling back to /tmp.
/opt/pihole/gravity.sh: line 343: 32 Segmentation fault (core dumped) timeout 4 getent hosts "${lookupDomain}" &> /dev/null
[✗] DNS resolution is currently unavailable
[✓] DNS resolution is available
/opt/pihole/gravity.sh: line 1019: 34 Segmentation fault (core dumped) mkdir -p "${listsCacheDir}"
/opt/pihole/gravity.sh: line 1019: 35 Segmentation fault (core dumped) mv "${piholeDir}"/list.* "${listsCacheDir}/" 2> /dev/null
[✗] Migrating the list's cache directory to new location
[i] Creating new gravity database
/opt/pihole/gravity.sh: line 67: 39 Segmentation fault (core dumped) chown pihole:pihole "${1}"
/opt/pihole/gravity.sh: line 67: 40 Segmentation fault (core dumped) chmod 664 "${1}"
/opt/pihole/gravity.sh: line 67: 42 Segmentation fault (core dumped) chmod g+w "$(dirname -- "${1}")"
[✗] Error creating new gravity database. Please contact support.
[✗] Unable to migrate to database. Please contact support.

[i] pihole-FTL pre-start checks
Segmentation fault (core dumped)
Segmentation fault (core dumped)
[i] Setting capabilities on pihole-FTL where possible
[i] Applying the following caps to pihole-FTL:
* CAP_CHOWN
* CAP_NET_BIND_SERVICE
* CAP_NET_RAW

Segmentation fault (core dumped)
Segmentation fault (core dumped)
Segmentation fault (core dumped)
Segmentation fault (core dumped)
Segmentation fault (core dumped)
Segmentation fault (core dumped)
Segmentation fault (core dumped)
Segmentation fault (core dumped)
Segmentation fault (core dumped)
Segmentation fault (core dumped)
Segmentation fault (core dumped)
Segmentation fault (core dumped)
Segmentation fault (core dumped)
Segmentation fault (core dumped)
[i] Starting pihole-FTL (no-daemon) as pihole

/usr/bin/start.sh: line 17: 88 Segmentation fault (core dumped) sleep 0.5