How can I preserve individual Docker container IPs in AdGuard Home DNS logs across Compose networks?

Use explicitly defined custom bridge networks rather than relying on Docker’s default network. For AdGuard, macvlan or another deliberately selected network mode may also be appropriate, depending on how it needs to communicate with the host and other containers. These options can preserve more useful addressing information, but they require extra routing and configuration, so test connectivity and isolation carefully.

The address rewriting is caused by NAT. It works much like several devices behind one home router: an outside service sees the router’s address instead of each device’s private address. Changing the Docker network driver may avoid this, but it also changes the isolation and routing behavior, so it should be done deliberately rather than simply merging all applications into one bridge.

One possible design is to create a dedicated external Docker network for DNS. Give the AdGuard container a fixed address on that network, attach containers from each application to the same network, and configure their DNS setting to use AdGuard’s address. For example, the DNS network could use a subnet such as 172.20.0.0/16 with AdGuard at 172.20.0.10. This gives the containers a directly shared network path to AdGuard, although you should verify whether the resulting source addresses are preserved in your particular setup and consider the reduced isolation.

Yes, this is Docker bridge networking and NAT behaving normally. Each Compose project gets its own bridge network, and when traffic leaves that network, Docker translates the source address to the network gateway. AdGuard therefore sees the gateway rather than the originating container. I would generally keep the networks separated instead of combining every stack into one large subnet. If knowing the exact container is important, you could attach containers to an additional shared DNS network, but that adds complexity and dependencies. In many cases, identifying the originating Compose stack is a sufficient compromise.