Self-host AdGuard Home

updated Sep 2026deployed by usprices checked · Jul 2026Install verified on Ubuntu 26.04 · Sep 2026 · how we test

We earn commissions when you shop through the links below. Full disclosure →

A single-binary, network-wide DNS ad and tracker blocker with a modern UI, built-in DoH/DoT encrypted DNS, and per-client rules out of the box. The polished alternative to Pi-hole.

Key facts

CategoryNetwork-wide ad blocking

LicenseGPL-3.0

StackGo

Min RAM512 MB

Official imageyes

Measured idle RAM11 MB

Difficulty

Sourcegithub.com/AdguardTeam/AdGuardHome

Websiteadguard.com/adguard-home/overview.html

Our recommendation

Pick AdGuard Home when you want DNS-level blocking with encrypted DNS built in: one GPL-3.0 Go binary that resolves over DoH, DoT, DoQ or DNSCrypt upstream and can serve them too, with per-client rules, parental and safe-search filters and an optional DHCP server, all configured from a web UI after a one-page wizard. The README's own comparison lists what Pi-hole needs extra software for. It is still a 0.107.x release stream — solid in practice, but read the changelog when you pull `latest`.

What you need

Any VPS with at least 512 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
Under an hour if you've used Docker before

Where to host itaffiliate disclosure

Hetzner Cloudrun it on

From $23.59/mo · 2 vCPU / 4 GB / 80 GB · EU + US

Get Hetzner Cloud

Kamaterafree trial

From $4/mo · 1 vCPU / 1 GB / 20 GB · US + EU + Asia

Start free on Kamatera →

DigitalOceanalso works on

From $6/mo · 1 vCPU / 1 GB / 25 GB · US + EU + Asia

Deploy on DigitalOcean →

Paid link — we earn a commission if you shop through it.

Install with Docker Compose

Save this as compose.yml and run docker compose up -d:

# AdGuard Home — network-wide DNS filtering
services:
  adguardhome:
    image: adguard/adguardhome:latest
    ports: ["53:53/tcp", "53:53/udp", "3000:3000/tcp", "80:80/tcp"]
    volumes:
      - ./work:/opt/adguardhome/work
      - ./conf:/opt/adguardhome/conf
    restart: unless-stopped
# On Ubuntu, free port 53 first (adguard-dns.io/kb → AdGuard Home → Docker → "resolved daemon"):
#   sudo mkdir -p /etc/systemd/resolved.conf.d
#   printf '[Resolve]\nDNS=127.0.0.1\nDNSStubListener=no\n' | sudo tee /etc/systemd/resolved.conf.d/adguardhome.conf
#   sudo mv /etc/resolv.conf /etc/resolv.conf.backup && sudo ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf
#   sudo systemctl reload-or-restart systemd-resolved
# docker compose up -d  →  http://SERVER_IP:3000 for the first-run wizard

vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

AdGuard Home's Docker notes and README are candid about the limits of the approach and the container:

non-negotiablePort 53 is usually taken. On systemd hosts resolved listens on 127.0.0.53:53 and Docker "will fail to bind on port 53"; the wiki's fix is DNSStubListener=no plus DNS=127.0.0.1 in a resolved.conf.d drop-in, then re-linking /etc/resolv.conf — our snippet's comment covers only the first part. The knowledge base lists 3000/TCP for the initial wizard, 80/TCP for the UI afterwards and 53/UDP for DNS.

non-negotiableIn Docker's default bridge network every query arrives from the Docker gateway, so per-client settings and the client list see one client. The wiki's answer is --network host if you want real client IPs.

non-negotiableDNS blocking has a ceiling the README states plainly: "YouTube, Twitch ads; Facebook, Twitter, Instagram sponsored posts" and "any advertising that shares a domain with content cannot be blocked by a DNS-level blocker."

non-negotiableServing encrypted DNS to your devices needs a domain and a certificate (the wiki walks through Let's Encrypt via Certbot or Lego) and extra published ports — 443 TCP/UDP for DoH/HTTPS, 853 TCP for DoT, 853 UDP for DoQ — none of which our snippet opens. Also note the GitHub wiki pages now carry "This article is outdated" banners pointing at the knowledge base; read the KB first.

non-negotiablePre-1.0: v0.107.79 shipped in August 2026 and the changelog still carries a commented-out v1.0.0 placeholder with no date; patch releases arrive every few weeks and regularly carry security fixes (Go updates, a DNS-over-QUIC resource-exhaustion advisory in .79). The 512 MB floor is our estimate — upstream publishes no RAM figure.