A Docker image of Knot Resolver configured to automatically block ads, tracking and malware domains with hBlock.

docker run --detach \
  --name hblock-resolver \
  --publish 127.0.0.153:53:53/udp \
  --publish 127.0.0.153:53:53/tcp \
  --publish 127.0.0.153:443:443/tcp \
  --publish 127.0.0.153:853:853/tcp \
  --publish 127.0.0.153:8453:8453/tcp \
  --mount type=volume,src=hblock-resolver-data,dst=/var/lib/knot-resolver/ \
  docker.io/hectorm/hblock-resolver:latest

Warning: do not expose this service to the open internet. An open DNS resolver represents a significant threat and it can be used in a number of different attacks, such as DNS amplification attacks.

Maximum cache size in megabytes.

IP (and optionally port) of the DNS-over-TLS server to which the queries will be forwarded (alternative DoT servers).

Hostname of the DNS-over-TLS server to which the queries will be forwarded (CA+hostname authentication docs).

Certificate hash of the DNS-over-TLS server to which the queries will be forwarded (key-pinned authentication docs).

Number of instances to launch.

Number of recently blocked domains to store in memory for each instance. The /recently_blocked endpoint returns an aggregated list of all instances.

If equals true, a self-signed certificate will be generated. You can provide your own certificate with these options:

  --env KRESD_CERT_MANAGED=false \
  --mount type=bind,src=/path/to/server.key,dst=/var/lib/knot-resolver/ssl/server.key,ro \
  --mount type=bind,src=/path/to/server.crt,dst=/var/lib/knot-resolver/ssl/server.crt,ro \

Note: for a more advanced setup, look at the following example with Let's Encrypt and Caddy.

If defined, kresd will only listen on the specified interface. Some users observed a considerable, close to 100%, performance gain in Docker containers when they bound the daemon to a single interface:ip address pair (dynamic configuration docs, CZ-NIC/knot-resolver#32).

Set the global logging level. The possible values are: crit, err, warning, notice, info or debug.

Main Knot DNS Resolver configuration is located in /etc/knot-resolver/kresd.conf. If you would like to add additional configuration, add one or more *.conf files under /etc/knot-resolver/kresd.conf.d/.

See the license file.