AdGuard Home

Ready-to-run files

Support level Official install

No Compose template from ANAROQ: install it the official way.

Why: AdGuard Home is a DNS server: devices must reach it on port 53 TCP/UDP of the host (plus 67/68 UDP for DHCP, 853 for DoT/DoQ, 80/443 for its web UI and DoH, 3000 for setup). ANAROQ templates only publish ports from 1024 up, on loopback or through the proxy, so they cannot serve DNS. On most Linux servers port 53 is also held by systemd-resolved's stub listener (127.0.0.53:53), which has to be turned off first, as the official Docker guide shows.

Open the official installation of AdGuard Home

Upgrade and rollback

How to move to a new version safely, and how to go back if it fails.

Back up first

Stop the container and copy AdGuardHome.yaml (from the conf volume) and the data directory (from the work volume), as the manual-update guide does; the running program overwrites the YAML, so do not copy or edit it while it runs. [1][3]

Upgrade steps

1. Read the CHANGELOG for every version between yours and the new one: each config migration (schema_version) is listed there with its manual rollback. [8]
2. In Docker the built-in updater is disabled: change the pinned adguard/adguardhome tag, docker pull it, then stop and remove the container and create it again with the same volumes and ports (or docker compose pull and up -d). [1][2]
3. Check the log and the dashboard version, then send a test query (for example a blocked domain) to the server's DNS address before moving clients back. [16]DerivedThe guides give no post-upgrade check; this follows their own test of a blocked domain against the server.

Roll back

Put back the AdGuardHome.yaml from before the upgrade and run the previous tag. The new release migrates the file to a newer schema_version, and the CHANGELOG only gives manual steps to undo each migration. [3][8]

Known breaking changes

• In 0.107.78: Rule lists are capped at filtering.max_http_size (256 MB by default), and HTTP/1.1 upgrades to H2C are refused. [8][11]
• In 0.107.74: Schema 33 → 34: tls.allow_unencrypted_doh was replaced by http.doh.insecure_enabled. DoH behind a reverse proxy needs the new key; the FAQ still shows the old one. [3][8][13]
• In 0.107.34: The image's HEALTHCHECK and tini entrypoint were removed. Some Docker tools cache the old ENTRYPOINT: back up the config, remove the container, purge the old image and pull again. [8]

Limits

• Port 53 must be free on the host. On Ubuntu and most systemd distributions systemd-resolved listens on 127.0.0.53:53: put DNS=127.0.0.1 and DNSStubListener=no in /etc/systemd/resolved.conf.d/adguardhome.conf, link /etc/resolv.conf to /run/systemd/resolve/resolv.conf and restart systemd-resolved. In Docker this is not done for you. [1][3]
• On Docker's bridge network every query seems to come from the bridge gateway (such as 172.17.0.1), so per-client settings, allowed clients and the query log cannot tell devices apart. The guide uses --network host for real client IPs, and it is required for the DHCP server. [1]
• Memory grows with the total number of filtering rules (measured 64 MB with the default 185,000 rules, 188 MB with 1.1 million, with higher peaks while lists reload). The query log keeps 90 days on disk by default; set querylog.interval lower on busy servers. [9][13][17]
• Statistics need a file system that supports mmap(2); some network or special file systems do not, so keep the work volume on a local disk. [2]

Security

• Do not run an open resolver on a public server: it invites DDoS and amplification abuse. Firewall 53 to your own networks, or turn on Allowlist mode (allowed clients by ClientID or IP), or disable plain DNS and serve only DoH/DoT. Plain DNS is rate-limited to 20 queries/s per subnet by default. [4][9]
• On first start the setup wizard listens on 0.0.0.0:3000 and whoever finishes it creates the admin account. Keep 3000 closed to the internet (publish it on 127.0.0.1 and use an SSH tunnel) until setup is done. [2][9]
• Behind a reverse proxy, put the proxy's address in trusted_proxies so AdGuard Home reads the real client IP from its headers; otherwise every DoH client looks like the proxy and access settings judge the proxy, not the client. [13][14]
• The container runs as root (the image sets no USER). Keep the web UI on a private address or behind authentication at the proxy, and never publish the pprof port 6060. [1][5]

Backup

• Back up AdGuardHome.yaml (all settings, clients, custom rules and the admin password hash) and the data directory (statistics, query log, sessions, DHCP leases), with the container stopped: the running program overwrites the YAML. [1][3][13][15]
• The YAML alone restores a working server: blocklists are downloaded again from their URLs (every 24 hours by default), and only the history in the query log and statistics would be lost. [9][13]

Latest release

Newest upstream release

AdGuard Home 0.107.79 [7][8]

This profile was checked against

AdGuard Home 0.107.79

This profile was checked against the newest release.

Checked on

14 Oct 2026

State

Checked within the last 90 days

Where releases are published

GitHub Releases

Checked 2026-10-14: v0.107.79 (2026-08-18 on Docker Hub) is the newest stable tag. v0.108.0-b.91 and v1.0.0-b.1 (new UI and versioning) are betas, and v0.107.80 is only planned in the CHANGELOG.

Latest releases of every app

Version

Profile status

Published

Checked against release

AdGuard Home 0.107.79

Profile version

1.0.0

Figures verified

14 Oct 2026

Catalog release

2026.10.10

Sizing policy

2026.10.0

Compose file

Not available yet

Project and alternatives

Official site

adguard.com/en/adguard-home/overview.html

Source code

github.com/AdguardTeam/AdGuardHome

Alternatives

Pi-holeTechnitium DNS Server

Sources

1. AdGuard Home KB: Docker (volumes /opt/adguardhome/work and conf; ports 53, 67/68, 80, 443, 3000, 853, 5443, 6060; --network host for client IPs and DHCP; DNSStubListener=no) (Official docs · read 14 Oct 2026)
2. AdGuard Home KB: Getting started (needs 3000/TCP setup, 80/TCP web UI, 53/UDP DNS; wizard on 0.0.0.0:3000; Docker auto-update disabled; setcap; mmap limitation) (Official docs · read 14 Oct 2026)
3. AdGuard Home KB: FAQ (bind: address already in use = systemd-resolved on 127.0.0.53:53, fix by hand in Docker; reverse proxy; manual update backs up AdGuardHome.yaml and data/) (Official docs · read 14 Oct 2026)
4. AdGuard Home KB: Running securely (public server exposed to DDoS; Allowlist mode with allowed clients; disable plain DNS; default plain-DNS ratelimit 20) (Official docs · read 14 Oct 2026)
5. AdguardTeam/AdGuardHome docker/build.Dockerfile at v0.107.79 (alpine:3.23, setcap cap_net_bind_service, dirs owned by nobody, no USER, no HEALTHCHECK, EXPOSE 53…6060) (Official repository · read 14 Oct 2026)
6. Docker Hub: adguard/adguardhome v0.107.79 image (linux/amd64 29,487,891 B compressed; config: no User, no Healthcheck; CMD -c conf/AdGuardHome.yaml -w work) (Official repository · read 14 Oct 2026)
7. Docker Hub: adguard/adguardhome tags (v0.107.79 newest stable on 2026-08-18; v0.108.0-b.91 and v1.0.0-b.1 are betas) (Official repository · read 14 Oct 2026)
8. AdguardTeam/AdGuardHome CHANGELOG.md at v0.107.79 (schema migrations with rollback steps; 0.107.74 http.doh; 0.107.78 rule-list size limit; 0.107.34 HEALTHCHECK removed) (Release notes · read 14 Oct 2026)
9. AdguardTeam/AdGuardHome internal/home/config.go at v0.107.79 (defaults: web 0.0.0.0:3000, ratelimit 20, cache 4 MiB, query log 90 days, statistics 1 day, AdGuard DNS filter) (Official repository · read 14 Oct 2026)
10. AdguardTeam/AdGuardHome internal/querylog/querylogfile.go at v0.107.79 (rotation renames querylog.json to querylog.json.1 once the oldest entry passes the interval) (Official repository · read 14 Oct 2026)
11. AdguardTeam/AdGuardHome internal/filtering/rulelist/rulelist.go at v0.107.79 (DefaultMaxRuleListSize = 256 MB) (Official repository · read 14 Oct 2026)
12. AdguardTeam/AdGuardHome README.md at v0.107.79 (based on the software behind the public AdGuard DNS servers, sharing a lot of code) (Official repository · read 14 Oct 2026)
13. AdGuard Home KB: Configuration (querylog and statistics interval 1h–8760h, allowed_clients, trusted_proxies, http.doh.insecure_enabled, cache_size) (Official docs · read 14 Oct 2026)
14. AdGuard Home KB: Encryption (DoH, DoT, DoQ, DNSCrypt; behind a reverse proxy set trusted_proxies to the proxy address) (Official docs · read 14 Oct 2026)
15. AdGuard Home KB: DHCP (leases stored in data/leases.json) (Official docs · read 14 Oct 2026)
16. AdGuard Home wiki: VPS (check the server with host doubleclick.net against it; a blocked domain answers NXDOMAIN) (Official docs · read 14 Oct 2026)
17. ANAROQ measurement 2026-10-14, v0.107.79 amd64 binary from this image: RSS 64 MB (peak 92 MB) with 184,525 rules; 188 MB (peak 332 MB) with 1,113,090 rules, 25.3 MB of lists (Measurement · read 14 Oct 2026)
18. ANAROQ measurement 2026-10-14, v0.107.79: 8,000 queries wrote 2,680,363 B to querylog.json (blocked entries ~325 B, answered ~375 B); stats.db 16 KiB (Measurement · read 14 Oct 2026)
19. AdGuard DNS home page (hosted DNS filtering with a dashboard, by Adguard Software Ltd.) (Official docs · read 14 Oct 2026)
20. AdGuard DNS KB: Private DNS overview (custom blocklists and rules, query log, statistics, parental control; between public AdGuard DNS and AdGuard Home) (Official docs · read 14 Oct 2026)