I'm deploying AdGuard Home with Docker Compose on a server using a 10.0.0.XX address. The container starts successfully and its logs show that the first-run web interface is listening on port 3000 inside the container, including on 0.0.0.0:3000. However, I cannot open http://10.0.0.XX:3003 from another machine.
My relevant port mappings are:
- "10.0.0.XX:53:53/tcp"
- "10.0.0.XX:53:53/udp"
- "10.0.0.XX:3003:3003/tcp"
- "10.0.0.XX:8080:80/tcp"
The logs also report that /opt/adguardhome/work has permissions 0755 but AdGuard Home expects 0700. The bind-mounted host directories were created as root, while the parent directory and Compose file belong to my normal user. I tried recursively changing ownership and setting everything to mode 700, but then AdGuard Home complained that a database file expected mode 0600 had mode 0700. There is also a DHCP warning about an invalid IPv4 address. What should be corrected in the Compose file and filesystem permissions?
3 Answers
The DHCP warning usually means AdGuard Home was given an invalid or placeholder address for its DHCP configuration. DHCP is optional, so disable DHCP during setup unless you specifically need the container to provide DHCP, and make sure any configured address is a complete IPv4 address such as 10.0.0.25 rather than a value containing XX. Also verify that 10.0.0.XX is the server’s actual interface address and that the host firewall allows TCP 3003.
The permission message is a warning, not the reason the web page cannot be reached. Avoid using chmod -R 700 on the entire tree because that gives regular files directory-style permissions. Set ownership and directory/file modes separately, for example:
sudo chown -R 1000:1000 /home/MYUSERNAME/adguardhome/adguard
find /home/MYUSERNAME/adguardhome/adguard -type d -exec chmod 700 {} +
find /home/MYUSERNAME/adguardhome/adguard -type f -exec chmod 600 {} +
If the image runs as a different UID, use that UID:GID instead of 1000:1000. The mounted work and conf directories should be writable by the user running AdGuard Home. You can confirm the container UID with `docker exec adguardhome id`.
The main connectivity problem is the port mapping. The logs show AdGuard Home listening on port 3000 inside the container, but the Compose file maps host port 3003 to container port 3003. Nothing is listening on container port 3003. Change that line to:
"10.0.0.XX:3003:3000/tcp"
Then open http://10.0.0.XX:3003. The 8080 mapping is for container port 80 and is unrelated to the first-run setup server. Alternatively, configure AdGuard Home to use another internal port, but the host and container ports must match the actual listener.
That explains why the logs only mention port 3000. I was changing the host port but accidentally changed the container side too.
The individual-file warning after chmod -R 700 is expected: files such as sessions.db should be 0600, while directories should generally be 0700. Fixing them separately avoids that mismatch.