Simon L.
ac112f3b42
dnsmasq runs in host network mode and auto-detects the host's LAN IP. On Docker Desktop (Windows/macOS) containers run inside a Linux VM isolated from the real host LAN, so detection yields the wrong IP and local DNS resolution does not work. Call this out in the dnsmasq readme and the in-app deSEC domain notice. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Simon L. <szaimen@e.mail.de>
Dnsmasq (Local DNS) community container
This container runs dnsmasq pre-configured to resolve your Nextcloud domain (NC_DOMAIN) to the server's local LAN IP address.
Why is this needed?
By default, all devices on your LAN reach Nextcloud via the public internet (or require hairpin NAT on your router). With this container, LAN clients can resolve NC_DOMAIN directly to the server's private LAN IP, making local access faster and independent of your internet connection.
This container is automatically enabled when you register a deSEC domain through the AIO interface.
How it works
On startup the container:
- Detects the server's primary LAN IP address automatically. ⚠️ This only works on a native Linux host. On Docker Desktop (Windows/macOS) the container runs inside Docker's Linux VM, so "host network mode" does not reach the real host LAN and the detected IP will not be the machine's actual LAN IP.
- Configures dnsmasq to resolve
NC_DOMAIN(and all its subdomains) to that IP. - Forwards all other DNS queries to the upstream nameservers from the host's
/etc/resolv.conf. - Listens only on the LAN interface to avoid conflicts with any system DNS resolver (e.g.
systemd-resolved).
Required router configuration
⚠️ You must change your router's DHCP settings for this to take effect for LAN clients:
Set the DNS server handed out by DHCP to the local IP address of this server (the same IP that is printed in the container logs on startup). After saving the change, LAN devices need to renew their DHCP lease (or be rebooted) before the new DNS setting takes effect.
Most routers expose this under DHCP settings → Primary DNS or LAN → DNS Server.
Notes
- The automatic LAN IP detection (and host-network port 53 binding) only works on a native Linux host. It does not work on Docker Desktop (Windows/macOS), where containers run inside a Linux VM that is isolated from the real host LAN.
- This container should only be used in home networks as on public servers this might cause a security risk exposing a dns server publicly
- This container is incompatible with the pi-hole community container as both need ports 53 to work correctly. Do not enable both at the same time!
- The container runs in host network mode so it can bind directly to port 53 on the LAN interface. No additional port-forwarding is required.
- IPv6 addresses are not handled by this container; extend the dnsmasq configuration manually if needed.
- See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack
Repository
https://github.com/szaimen/aio-dnsmasq