Due to changes in my living situation, I've switched from running Pi-Hole on a headless machine on my network, to running it locally on my main PC; which runs EndeavourOS.

Pi-Hole is working well; with my networking settings set to use 127.0.0.1 and ::1 to point to localhost for DNS, but I can't boot Waydroid unless I either comment out the dnsmasq lines in /usr/lib/waydroid/data/scripts/waydroid-net.sh, or stop pihole-FTL.service.

Stopping pihole-FTL.service, of course stops Pi-Hole, and commenting out those dnsmasq lines disables networking in Waydroid.

I'd like to be able to get Waydroid running with networking, and preferably get it to use Pi-Hole as its DNS resolver. I understand the reason Waydroid won't boot normally in my case is because it does some weird stuff with dnsmasq and port 53, which conflicts with Pi-Hole.

I should also mention that I'm also using ufw for a firewall, with default deny incoming and default allow outgoing set.

Why not run pi-hole in a docker/podman/lxc container/VM?

Would that make this easier? I have no experience using things like Docker or Podman.

It would make it easier in that way that docker/podman container services are on an seperate internal network, this means that waydroid and pihole will not come in conflict over the dns port on localhost anymore.

I see. Would I be able to set this up so that only my machine is able to access this? I'm sharing a LAN with family and don't 100% trust all the devices on the network.

The docker network is internal to the Pc, so access is by default linited to the machine. External access would need port mappings or other means of forwarding to be configured.

Isn't Pi-Hole usually expected to be accessed by other machines on LAN though? I've been looking at the official Docker compose file (https://github.com/pi-hole/docker-pi-hole/#quick-start), and I wonder what I'd need to change to make it accessible only to my machine and other VMs running on it.

I haven’t used pihole in some time, but I believe it has an option where you can set allowed networks and it will ignore requests from other devices.

Keep in mind docker will bypass iptables and ufw firewall rules. Podman does not afaik

Pi-Hole has an option to bind only to a specific interface, if that's what you're talking about, but that's for Pi-Hole itself and not the Docker container it's running under.

You can try using this compose.yml
After booting it up, you should be able to simply point DNS at 172.18.1.2 and administer it via https://172.18.1.2/admin

  pihole:
    container_name: pihole
    hostname: pihole
    restart: unless-stopped
    image: pihole/pihole:latest
    environment:
      TZ: 'Your/Time_Zone'
      FTLCONF_webserver_api_password: ''
    volumes:
      - 'pihole_settings:/etc/pihole/'
    networks:
      default: 
        ipv4_address: 172.18.1.2
    cap_add:
      - CAP_NET_BIND_SERVICE
      - CAP_SYS_NICE
      - CAP_CHOWN
    cap_drop:
      - CAP_NET_RAW
      - CAP_NET_ADMIN
      - CAP_SYS_TIME
    logging: 
      driver: json-file
      options:
        max-size: "12m"
        max-file: "5"

volumes:
  pihole_settings:

networks:
  default:
    enable_ipv4: true
    enable_ipv6: false
    ipam:
      driver: default
      config:
        - subnet: 172.18.1.0/24
          ip_range: 172.18.1.0/24
          gateway: 172.18.1.1

I got Pi-Hole working using your compose file, though I had to reference the official example since it was missing "services:" at the top.

I also referenced this tutorial video and added my user to the docker group, which I'm not sure I'm supposed to do or not: https://youtu.be/0X4mxj-uYsc

Anyway, right now I have IPv6 disabled. Would I be able to get this working with IPv6, or would it be more trouble than it's worth?

I also just realized I haven't tried to get Waydroid running yet. Will have to see if that works at all.

EDIT: Waydroid runs, though it doesn't have internet access. This is still a step in the right direction though, since it boots with the stock /usr/lib/waydroid/data/scripts/waydroid-net.sh file while Pi-Hole is running.

Totally forgot the services line - I pulled that from my own docker compose that uses another container to tunnel all my DNS traffic to Cloudflare via HTTPS instead of bare DNS (for privacy from ISP snooping, for what it’s worth)…
It’s fine to put your own user in the docker group as long as your account is reasonably secure and it fits with your security model. IPv6 resolution should work out-of-the-box with that config - it’ll just use IPv4 to communicate with your PC and upstream DNS (it can still resolve AAAA records over that connection). I don’t personally use Waydroid so I have no idea why it’s still not working but, as you said, it seems like a step in the right direction

I appreciate the help, even though I still haven't got things working 100%.

Question, if I have IPv6 disabled on my system, do I need to keep my upstream IPv6 DNS providers enabled in Pi-Hole? Every so often I get errors saying that Pi-Hole can't reach them.

No, you shouldn’t need to enable the ipv6 resolvers - they’ll just fail anyway… even if you did have ipv6 enabled on your system, you don’t need the ipv6 resolvers - the IPv4 and ipv6 addresses are pointing to the same server regardless

Of course! No skin off my back - happy I could help get it at least part of the way there

That makes sense. Thanks. :D