Pi-Hole - "missing required capability NET_ADMIN"

Support and Troubleshooting
11

You have to set it up to run a different docker network and assign it an IP. The reason being that there’s no way to forward broadcasts to the internal docker network.

Here’s my docker-compose.yml .

version: "3.7"

services:
  server:
    image: pihole/pihole
    # Pi-hole doesn't currently support running as non-root
    # https://github.com/pi-hole/docker-pi-hole/issues/685
    # user: "1000:1000"
    restart: on-failure
    cap_add:
      - NET_ADMIN
    volumes:
      - ${APP_DATA_DIR}/data/pihole:/etc/pihole/
      - ${APP_DATA_DIR}/data/dnsmasq:/etc/dnsmasq.d/
    environment:
      - VIRTUAL_HOST=${APP_DOMAIN}
      - WEBPASSWORD=${APP_PASSWORD}
    networks:
      default:
        ipv4_address: 192.168.1.253 #available IP to assign statically to Pi-Hole. Note, this isn't actually assigned to an interface. Just an IP for the docker container really

networks:
  default:
    driver: macvlan
    driver_opts:
      parent: eth0
    ipam:
      config:
        - subnet: 192.168.1.0/24
          gateway: 192.168.1.1
          ip_range: 192.168.1.248/29 #network address of range

Basically the macvlan network will be assigned the .253 IP address and a virtual MAC to receive BOOTP broadcasts. Also note, since it has an ‘external’ IP, no need for port forwarding anymore.

2 Likes