Pi-hole vs AdGuard Home on one 300,000-domain list

# Fixed addresses because Pi-hole upstreams must be IPs. coredns is the shared local upstream; lists serves the generated blocklist.
services:
  coredns:
    image: coredns/coredns:1.14.7
    command: ["-conf", "/Corefile"]
    volumes: ["./Corefile:/Corefile:ro"]
    networks: { dnsnet: { ipv4_address: 172.28.0.10 } }
  lists:
    image: nginx:1.31.8-alpine
    volumes: ["./lists.conf:/etc/nginx/conf.d/default.conf:ro", "./blocklist.txt:/lists/blocklist.txt:ro"]
    networks: { dnsnet: { ipv4_address: 172.28.0.11 } }
  pihole: &pihole
    profiles: [pihole]
    image: pihole/pihole:2026.10.1
    environment:
      TZ: UTC
      FTLCONF_webserver_api_password: lab-only-not-a-secret
      FTLCONF_dns_listeningMode: ALL
      FTLCONF_dns_upstreams: 172.28.0.10
      FTLCONF_dns_rateLimit_count: "0"
    volumes: ["pihole_etc:/etc/pihole"]
    networks: { dnsnet: { ipv4_address: 172.28.0.20 } }
  # second attempt: same container with a larger /dev/shm (Docker's default is 64 MB)
  pihole-shm:
    <<: *pihole
    profiles: [pihole-shm]
    shm_size: 512mb
  adguard:
    profiles: [adguard]
    image: adguard/adguardhome:v0.107.79
    volumes: ["adguard_work:/opt/adguardhome/work", "adguard_conf:/opt/adguardhome/conf"]
    networks: { dnsnet: { ipv4_address: 172.28.0.21 } }
networks:
  dnsnet:
    ipam: { config: [{ subnet: 172.28.0.0/24 }] }
volumes:
  pihole_etc:
  adguard_work:
  adguard_conf:

#!/usr/bin/env bash
# Runs inside the VM from ~/dns. Raw outputs in ~/dns/raw. One resolver at a time; coredns (upstream) and nginx (list server) stay up.
set -u
cd "$HOME/dns"; mkdir -p raw
export COMPOSE_PROJECT_NAME=dns
NET=dns_dnsnet
DNSPYRE=ghcr.io/tantalor93/dnspyre:v3.12.0
now() { date +%s.%N; }
el() { python3 -c "print(round($2 - $1, 2))"; }
log() { echo "== $* $(date -u +%T)"; }
dig() { docker run --rm --network "$NET" dnstools dig "$@"; }

docker build -q -t dnstools -f Dockerfile.dnstools . > raw/build.txt 2>&1
for i in $DNSPYRE coredns/coredns:1.14.7 nginx:1.31.8-alpine pihole/pihole:2026.10.1 adguard/adguardhome:v0.107.79; do docker pull -q $i > /dev/null; done
docker image ls --digests --format '{{.Repository}}:{{.Tag}} {{.Digest}}' > raw/images.txt
docker run --rm $DNSPYRE --version > raw/dnspyre-version.txt 2>&1
docker run --rm $DNSPYRE --help > raw/dnspyre-help.txt 2>&1
sha256sum blocklist.txt blocked-queries.txt allowed-queries.txt > raw/list-sha256.txt
wc -l blocklist.txt blocked-queries.txt allowed-queries.txt > raw/list-lines.txt
docker compose up -d coredns lists > /dev/null 2>&1; sleep 3
dig @172.28.0.10 +short anything.allowed.example.net A > raw/upstream-check.txt 2>&1

load() { # load <label> <server-ip> <queryfile>  (3 runs)
  local label="$1" ip="$2" qf="$3"
  # warm-up so the cache is filled for the allowed workload
  docker run --rm --network "$NET" -v "$PWD:/q:ro" $DNSPYRE --server "$ip" --concurrency 16 --duration 5s --no-distribution "file:///q/$qf" > /dev/null 2>&1
  for i in 1 2 3; do
    flag=raw/.sampling; touch $flag; : > raw/$label.run$i.stats.txt
    ( while [ -e $flag ]; do docker stats --no-stream --format '{{.MemUsage}} {{.CPUPerc}}' "$CID" >> raw/$label.run$i.stats.txt 2>/dev/null; done ) &
    sp=$!
    docker run --rm --network "$NET" -v "$PWD:/q:ro" $DNSPYRE --server "$ip" --concurrency 16 --duration 15s --no-color --no-progress "file:///q/$qf" > raw/$label.run$i.txt 2> raw/$label.run$i.err
    rm -f $flag; wait $sp
  done
}

answers() { # answers <label> <ip>
  local label="$1" ip="$2" b a
  b=$(head -1 blocked-queries.txt); a=$(head -1 allowed-queries.txt)
  { echo "# blocked name: $b"; dig @"$ip" "$b" A; dig @"$ip" "$b" AAAA +short; echo "# allowed name: $a"; dig @"$ip" "$a" A; } > raw/$label.answers.txt 2>&1
}

# ---------------- Pi-hole (run twice: Docker's default /dev/shm, then 512 MB)
run_pihole() { # run_pihole <label> <compose-service>
  local L="$1" SVC="$2"
  log "$L"
  docker compose --profile "$SVC" up -d "$SVC" > /dev/null 2>&1; CID=$(docker compose ps -q "$SVC")
  T0=$(now)
  for _ in $(seq 1 180); do  # any HTTP answer (the API replies 401 without a session) means the web server is up
    c=$(docker run --rm --network "$NET" dnstools curl -s -m3 -o /dev/null -w '%{http_code}' http://172.28.0.20/admin/ 2>/dev/null); [ "$c" != 000 ] && [ -n "$c" ] && break; sleep 1
  done
  echo "api_ready_seconds $(el "$T0" "$(now)")" > raw/$L.ready.txt
  PH() { docker run --rm --network "$NET" dnstools curl -s -m60 "$@"; }
  SID=$(PH -X POST http://172.28.0.20/api/auth -H 'content-type: application/json' -d '{"password":"lab-only-not-a-secret"}' | jq -r .session.sid)
  sleep 30   # let the first-start gravity run (default list, needs internet) finish before replacing the list
  PH -H "sid: $SID" http://172.28.0.20/api/lists > raw/$L.lists-before.json
  for addr in $(jq -r '.lists[].address' raw/$L.lists-before.json); do
    PH -X DELETE -H "sid: $SID" "http://172.28.0.20/api/lists/$(python3 -c "import urllib.parse,sys;print(urllib.parse.quote(sys.argv[1],safe=''))" "$addr")?type=block" -o /dev/null -w "delete $addr -> %{http_code}\n"
  done > raw/$L.delete-default-list.txt
  PH -H "sid: $SID" -X POST "http://172.28.0.20/api/lists?type=block" -H 'content-type: application/json' \
    -d '{"address":"http://172.28.0.11/blocklist.txt","comment":"generated","groups":[0],"enabled":true}' > raw/$L.add-list.json
  T0=$(now)
  PH -H "sid: $SID" -X POST http://172.28.0.20/api/action/gravity > raw/$L.gravity.txt 2>&1
  echo "gravity_seconds $(el "$T0" "$(now)")" > raw/$L.gravity-time.txt
  sleep 5
  PH -H "sid: $SID" http://172.28.0.20/api/stats/summary | jq '.gravity' > raw/$L.gravity-summary.json
  for _ in $(seq 1 12); do docker stats --no-stream --format '{{.MemUsage}} {{.CPUPerc}}' "$CID"; done > raw/$L.idle.txt
  docker exec "$CID" df -m /dev/shm > raw/$L.shm-before.txt 2>&1
  answers "$L" 172.28.0.20
  load $L.allowed 172.28.0.20 allowed-queries.txt
  docker exec "$CID" df -m /dev/shm > raw/$L.shm-after-allowed.txt 2>&1
  load $L.blocked 172.28.0.20 blocked-queries.txt
  docker exec "$CID" df -m /dev/shm > raw/$L.shm-after-blocked.txt 2>&1
  docker inspect "$CID" --format 'state={{.State.Status}} exit_code={{.State.ExitCode}} restarts={{.RestartCount}}' > raw/$L.final-state.txt 2>&1
  docker compose logs --no-color --tail=40 "$SVC" > raw/$L.logs-tail.txt 2>&1
  docker compose --profile "$SVC" rm -sfv "$SVC" > /dev/null 2>&1; docker volume rm -f dns_pihole_etc > /dev/null 2>&1
}
run_pihole pihole pihole
run_pihole pihole-shm pihole-shm

# ---------------- AdGuard Home
log adguard
docker compose --profile adguard up -d adguard > /dev/null 2>&1; CID=$(docker compose ps -q adguard)
T0=$(now)
for _ in $(seq 1 120); do
  c=$(docker run --rm --network "$NET" dnstools curl -s -m3 -o /dev/null -w '%{http_code}' http://172.28.0.21:3000/ 2>/dev/null); { [ "$c" = 200 ] || [ "$c" = 302 ]; } && break; sleep 1
done
echo "setup_ready_seconds $(el "$T0" "$(now)")" > raw/adguard.ready.txt
AG() { docker run --rm --network "$NET" dnstools curl -s -m120 "$@"; }
AG -X POST http://172.28.0.21:3000/control/install/configure -H 'content-type: application/json' \
  -d '{"web":{"ip":"0.0.0.0","port":80},"dns":{"ip":"0.0.0.0","port":53},"username":"lab","password":"lab-only-not-a-secret"}' -o /dev/null -w 'install/configure -> %{http_code}\n' > raw/adguard.install.txt 2>&1
for _ in $(seq 1 120); do
  [ "$(docker run --rm --network "$NET" dnstools curl -s -m3 -u lab:lab-only-not-a-secret -o /dev/null -w '%{http_code}' http://172.28.0.21/control/status 2>/dev/null)" = 200 ] && break; sleep 1
done
AU="-u lab:lab-only-not-a-secret"
AG $AU http://172.28.0.21/control/filtering/status > raw/adguard.filters-before.json
for u in $(jq -r '.filters[]?.url' raw/adguard.filters-before.json); do
  AG $AU -X POST http://172.28.0.21/control/filtering/remove_url -H 'content-type: application/json' -d "{\"url\":\"$u\",\"whitelist\":false}" -o /dev/null -w "remove $u -> %{http_code}\n"
done > raw/adguard.remove-default-filter.txt
AG $AU -X POST http://172.28.0.21/control/dns_config -H 'content-type: application/json' \
  -d '{"upstream_dns":["172.28.0.10"],"ratelimit":0}' -o /dev/null -w 'dns_config -> %{http_code}\n' > raw/adguard.dns-config.txt 2>&1
AG $AU http://172.28.0.21/control/dns_info > raw/adguard.dns-info.json
T0=$(now)
AG $AU -X POST http://172.28.0.21/control/filtering/add_url -H 'content-type: application/json' \
  -d '{"name":"generated","url":"http://172.28.0.11/blocklist.txt","whitelist":false}' > raw/adguard.add-list.txt 2>&1
echo "add_url_seconds $(el "$T0" "$(now)")" > raw/adguard.add-list-time.txt
sleep 5
AG $AU http://172.28.0.21/control/filtering/status > raw/adguard.filters-after.json
for _ in $(seq 1 12); do docker stats --no-stream --format '{{.MemUsage}} {{.CPUPerc}}' "$CID"; done > raw/adguard.idle.txt
answers adguard 172.28.0.21
load adguard.allowed 172.28.0.21 allowed-queries.txt
load adguard.blocked 172.28.0.21 blocked-queries.txt
docker compose logs --no-color --tail=40 adguard > raw/adguard.logs-tail.txt 2>&1
docker compose --profile adguard down -v > /dev/null 2>&1
echo done > raw/DONE