Running Pi-hole on Proxmox VE: LXC Container Guide

Why Pi-hole on Proxmox?

Pi-hole is a network-wide ad blocker that acts as your DNS server, filtering out advertising and tracking domains before they reach any device on your network. Running Pi-hole in a Proxmox LXC container is the ideal setup — it uses minimal resources (as little as 64 MB RAM and a fraction of a CPU core), starts in seconds, and benefits from Proxmox's backup and snapshot capabilities.

Unlike running Pi-hole on a Raspberry Pi, an LXC container on Proxmox eliminates SD card reliability concerns and gives you a more robust, easily recoverable deployment.

Creating the LXC Container

First, download a Debian container template if you do not already have one. From the Proxmox web UI, go to your storage, click CT Templates, and download the latest Debian 12 template. Alternatively, use the command line:

# Download the Debian 12 template
pveam update
pveam download local debian-12-standard_12.7-1_amd64.tar.zst

Now create the LXC container. Pi-hole is very lightweight, so minimal resources are sufficient:

# Create the Pi-hole LXC container
pct create 120 local:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst \
  --hostname pihole \
  --memory 256 \
  --cores 1 \
  --rootfs local-lvm:4 \
  --net0 name=eth0,bridge=vmbr0,ip=10.0.0.53/24,gw=10.0.0.1 \
  --nameserver 1.1.1.1 \
  --unprivileged 1 \
  --start 1 \
  --onboot 1

Key settings explained:

• 256 MB RAM — More than enough for Pi-hole. You can go as low as 128 MB, but 256 MB provides comfortable headroom.
• 4 GB disk — Pi-hole's gravity database and logs easily fit in this space.
• Static IP 10.0.0.53 — A DNS server must have a static IP. Using .53 is a common convention (port 53 is DNS).
• nameserver 1.1.1.1 — Temporary upstream DNS used during setup. Pi-hole will handle DNS once installed.
• onboot 1 — Ensures Pi-hole starts automatically when Proxmox boots.

Installing Pi-hole

Enter the container and install Pi-hole using the official installer script:

# Enter the container
pct enter 120

# Update packages
apt update && apt upgrade -y

# Install curl (needed for the installer)
apt install -y curl

# Run the Pi-hole installer
curl -sSL https://install.pi-hole.net | bash

The installer will walk you through several choices:

1. Upstream DNS provider — Choose Cloudflare (1.1.1.1), Google (8.8.8.8), or Quad9 (9.9.9.9). You can change this later.
2. Blocklists — Accept the default StevenBlack list. You can add more later.
3. Web admin interface — Select Yes to install the web UI.
4. Web server — Select Yes to install lighttpd.
5. Logging — Enable query logging for visibility into DNS requests.
6. Privacy mode — Choose your preferred level. "Show everything" is useful for a personal network.

At the end of the installation, Pi-hole displays a randomly generated admin password. Save this or change it immediately:

# Change the Pi-hole admin password
pihole -a -p your-new-password

Accessing the Web Interface

Open a browser and navigate to http://10.0.0.53/admin. Log in with your admin password. The dashboard shows real-time DNS query statistics, the percentage of queries blocked, and your top clients and domains.

Configuring Your Network to Use Pi-hole

For Pi-hole to work, your devices need to use it as their DNS server. You have two options:

• Router-level (recommended) — Set your router's DHCP DNS setting to 10.0.0.53. All devices on your network will automatically use Pi-hole without any per-device configuration.
• Per-device — Manually set the DNS server to 10.0.0.53 on individual devices. Useful if you only want certain devices to use Pi-hole.

If you run pfSense or OPNsense on Proxmox, configure the DHCP server there to hand out 10.0.0.53 as the DNS server:

## In pfSense/OPNsense DHCP settings:
DNS Server 1: 10.0.0.53
DNS Server 2: 1.1.1.1  (fallback in case Pi-hole is down)

Adding Blocklists

The default blocklist catches common ads and trackers, but you can add more for broader coverage. Go to Group Management > Adlists in the Pi-hole admin panel and add URLs. Some popular lists:

# Popular blocklists to add:
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/pro.txt
https://big.oisd.nl/domainswild
https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareHosts.txt

# After adding lists, update the gravity database
pihole -g

Tip: Start with one or two lists and monitor for false positives. If a legitimate site is blocked, whitelist it under Domains > Whitelist in the Pi-hole admin panel.

Keeping Pi-hole Updated

Pi-hole can be updated with a single command inside the container:

# Update Pi-hole
pihole -up

# Update the OS packages
apt update && apt upgrade -y

Before running major updates, take a Proxmox snapshot of the container so you can roll back if anything goes wrong:

# Snapshot the container before updating
pct snapshot 120 pre-update --description "Before Pi-hole update"

# If something breaks, restore the snapshot
pct rollback 120 pre-update

Monitoring Pi-hole on Proxmox

Pi-hole is critical infrastructure — if it goes down, DNS resolution stops for your entire network. Proxmox's web UI lets you monitor the container's status and resource usage. For quick checks when you are not at your desk, ProxmoxR lets you verify your Pi-hole container is running, check its resource consumption, and restart it if needed — all from your phone. This is particularly useful because a DNS outage affects every device on your network, so being able to respond quickly matters.

Running Pi-hole in a Proxmox LXC container is one of the easiest and most impactful services you can deploy. It protects every device on your network from ads and trackers, uses almost no resources, and benefits from Proxmox's robust backup and snapshot system.