pihole blocks ads and trackers for every device on the network

why your smart tv is calling home 200 times a day

every device on your network is out there making dns requests constantly. your phone, your smart tv, that "smart" fridge nobody asked for, they're all quietly asking "hey, where do i find ads.example.com" hundreds of times a day. dns is just the phonebook the internet uses to turn domain names into ip addresses. the problem is nobody vets what's in that phonebook, so ad networks and trackers are in there right next to legitimate sites, and your devices dial all of them without asking you first.

pi-hole sits between your devices and the internet as your own private phonebook. when something tries to look up a known ad or tracker domain, pi-hole just says "that number doesn't exist" and the request dies right there. no ad loads, no tracking pixel fires, no bandwidth wasted. and because it works at the network level, it protects every device that connects, not just the one you installed something on.

breaking down the command

here's the docker command that gets it running:

docker run -d --name pihole -e TZ=UTC -p 53:53/udp -p 80:80 pihole/pihole

docker run -d starts the container in detached mode, meaning it runs in the background instead of tying up your terminal.

--name pihole just gives the container a friendly name so you can reference it later instead of some random string of characters docker generates.

-e TZ=UTC sets the timezone inside the container. this matters more than people think, because pi-hole's logs and stats are only useful if the timestamps actually match reality. swap UTC for your own timezone if you want your dashboard to make sense at a glance.

-p 53:53/udp maps port 53, which is the standard dns port, from the container to your host machine. this is the actual mechanism doing the blocking, since dns traffic runs over udp on port 53.

-p 80:80 exposes the web interface, which is where you'll log in to see stats, manage blocklists, and whitelist anything that gets caught by mistake.

pihole/pihole is the official image, pulled straight from docker hub.

pointing your network at it

running the container is only half the job. right now nothing is using it yet. you have two options. you can go into your router's settings and change the dns server to the local ip address of the machine running pi-hole, which covers literally every device on the network automatically. or you can set dns manually on individual devices if you don't have router access, like on a work laptop or a guest network you don't control.

the router-level option is the one worth doing if you can, because it means new devices, guest phones, that random iot gadget you forgot you own, all get protected the moment they connect, with zero setup on the device itself.

what you'll actually see happen

once it's live, log into the pi-hole dashboard and watch the query log for a few minutes. you'll see a real-time feed of every domain every device on your network is trying to reach, and a growing number of them marked as blocked. it's genuinely eye-opening the first time, because you start to see just how much background chatter your devices generate without you ever knowing.

the number people usually quote is around a quarter of all dns requests on a typical home network are ads or trackers. that's a quarter of your bandwidth and battery life going to stuff that provides you zero value.

keeping it from breaking things

the one gotcha with any dns-level blocker is overblocking. sometimes a legitimate service shares infrastructure with a tracker domain, and blocking it breaks something you actually wanted to work, like a login button or a video player. when that happens, the fix is to check the query log, find the specific domain that got blocked, and whitelist it from the dashboard. it takes ten seconds and you won't need to do it often.

also worth doing regularly: update your blocklists. pi-hole doesn't auto-refresh its lists forever, so schedule a periodic pihole -g to pull the latest gravity list, or set it on a cron job so you're not manually babysitting it.

the takeaway

this is one of those rare security and privacy wins that costs you almost nothing. five minutes of setup, one docker command, one router setting, and every device on your network quietly stops loading a huge chunk of the junk that was tracking it and slowing it down. you don't need to trust an app on your phone to do this for you, you own the layer it happens at. that's the whole point of running your own infrastructure instead of hoping someone else's app is doing right by you.