Run with Docker

docker run -d --name warda --restart unless-stopped \
  -p 192.168.1.2:53:53/udp -p 192.168.1.2:53:53/tcp \
  -p 192.168.1.2:80:80 -p 192.168.1.2:443:443 \
  -e TZ=Europe/Paris -e WARDA_ADVERTISE_ADDR=192.168.1.2 \
  -v warda-data:/var/lib/warda \
  registry.example.com/warda-dns/warda:latest

Replace 192.168.1.2 with the local network address of the host. Publish the ports on that address only: published on every address, Docker relays IPv6 connections from its own gateway address, which Warda would take for a local client, so Warda could answer the internet.

Test it:

docker exec warda warda lookup -server 127.0.0.1:53 example.com
curl http://192.168.1.2/healthz
docker exec warda warda setup-info

The image has no shell and runs as a non-root user. It supports linux/amd64 and linux/arm64 (Raspberry Pi 4 and later with a 64-bit system).

In a bridged container Warda only sees the IP addresses of the devices, and WARDA_ADVERTISE_ADDR gives the host address for the name warda. To identify the devices by hardware address, which survives address changes, use host networking: packaging/docker-compose.yml does it. It runs Warda as the root user of the container (user: "0:0") with every capability dropped but NET_BIND_SERVICE (ports below 1024), NET_RAW (ping, traceroute, LLDP), DAC_OVERRIDE and FOWNER (the data directory of the image, owned by 65532), with no-new-privileges and a read-only file system.

The image is not updated by Warda: the System page tells when a new version is published (see Updates), and docker compose pull && docker compose up -d installs it.