Pi-hole

TAS Score: S3/3 – D5/5 – A3 / T2 Critical criteria for this category: Pause.

Brief Description

Network-wide ad blocker and DNS sinkhole. Blocks ads, trackers, and malware at the DNS level for every device on your network – without installing anything on individual devices.

Architectural Role

Network layer: DNS resolver with filtering. Sits between your devices and the internet, blocking unwanted domains before they load. Similar role to AdGuard Home.

Technical Autonomy

✅ Works without internet (local DNS resolution and filtering continue; upstream DNS requires internet)
✅ Stores data locally (configuration, blocklists, query logs)
✅ Does not require external accounts
✅ Allows data export (configuration and teleporter backup built in)
✅ Provides offline updates (manual upgrade via packages or Docker)

Philosophical Assessment (whose.world criteria)

Criterion	Status	Comments
Pause	Yes	Service can be disabled temporarily via web UI; DNS falls back to upstream.
Exit	Yes	No vendor lock-in. Teleporter exports full configuration. Point DNS elsewhere and you’re done.
Recoverability	Yes	Teleporter backup/restore. Configuration files can be version-controlled.
Visibility	Yes	Open source (EUPL-1.2), fully auditable. Query log shows exactly what’s blocked and why.
External Dependencies	Yes	No mandatory external services. Gravity (blocklist) updates need internet but can be done manually.

Configuration (Minimal)

Example docker-compose.yml snippet:

services:
  pihole:
    image: pihole/pihole:latest
    container_name: pihole
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "8053:80/tcp"
    volumes:
      - ./pihole-etc:/etc/pihole
      - ./pihole-dnsmasq:/etc/dnsmasq.d
    environment:
      WEBPASSWORD: change-me
    restart: unless-stopped

Minimal Autonomous Server – uses AdGuard Home for DNS filtering; Pi-hole is an alternative.

Alternatives

AdGuard Home – more modern UI, native DNS-over-HTTPS/QUIC, more features out of the box
Blocky – lightweight DNS proxy with blocklists, config-file only
NextDNS – cloud-based, not self-hosted, A0/T1

Trajectory

Direction: stable.

Pi-hole is EUPL-1.2 licenced and community-governed. Development continues actively. No corporate ownership, no enterprise tier, no cloud service. The project has been stable and consistent since 2014.

Signal assessment:

Signal	Status	Evidence
License	✅	EUPL-1.2; no changes since launch.
Feature gating	✅	No paid tier; all features free.
Self-hosting	✅	Self-hosting only; local DNS by design.
Governance	➖	Small core team; community active; no formal foundation but stable governance in practice.

Signal key: ✅ opening · ➖ neutral · ⚠️ closing