DockRoute

v1.0.0

External-DNS for plain Docker hosts — reconciles DNS records and Cloudflare Tunnel routes from container labels.

dns networking automation docker by danilodorgam

x-arcane:
  icon: https://github.com/Dockroute.png
  urls:
    - https://www.dockroute.dev
    - https://github.com/Dockroute/Dockroute

services:
  dockroute:
    image: ghcr.io/dockroute/dockroute:latest
    container_name: dockroute
    restart: unless-stopped
    environment:
      DOCKROUTE_PROVIDER: ${DOCKROUTE_PROVIDER:-log}
      DOCKROUTE_OWNER_ID: ${DOCKROUTE_OWNER_ID:-default}
      DOCKROUTE_POLICY: ${DOCKROUTE_POLICY:-sync}
      DOCKROUTE_DEFAULT_TARGET: ${DOCKROUTE_DEFAULT_TARGET:-}
      DOCKROUTE_DOMAIN_FILTER: ${DOCKROUTE_DOMAIN_FILTER:-}
      DOCKROUTE_RESYNC_SECONDS: ${DOCKROUTE_RESYNC_SECONDS:-60}
      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN:-}
      CLOUDFLARE_ACCOUNT_ID: ${CLOUDFLARE_ACCOUNT_ID:-}
      CLOUDFLARE_TUNNEL_ID: ${CLOUDFLARE_TUNNEL_ID:-}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    labels:
      com.getarcaneapp.arcane.icon: https://github.com/Dockroute.png

# DNS provider: "log" is a zero-credential dry run that only prints the
# desired state; switch to "cloudflare" when you are ready.
DOCKROUTE_PROVIDER=log

# Ownership id written to companion TXT records; lets several DockRoute
# instances share a zone safely.
DOCKROUTE_OWNER_ID=default

# sync = create/update/delete owned records; upsert-only = never delete;
# create-only = never update or delete.
DOCKROUTE_POLICY=sync

# Fallback record value (IP or CNAME target) when a container omits the
# dockroute.target label. E.g. your server's LAN or WAN IP.
DOCKROUTE_DEFAULT_TARGET=

# Optional comma-separated allowlist of DNS zones DockRoute may touch.
# Empty = all zones the token can see.
DOCKROUTE_DOMAIN_FILTER=

# Interval of the periodic full reconcile that backs up the event stream.
DOCKROUTE_RESYNC_SECONDS=60

# Required when DOCKROUTE_PROVIDER=cloudflare.
# Token permissions: Zone -> DNS -> Edit
# (+ Account -> Cloudflare Tunnel -> Edit for tunnel publishing).
CLOUDFLARE_API_TOKEN=

# Only needed for Cloudflare Tunnel publishing (existing tunnel — you keep
# running cloudflared yourself).
CLOUDFLARE_ACCOUNT_ID=
CLOUDFLARE_TUNNEL_ID=

README

External-DNS for plain Docker hosts — the same idea as Kubernetes external-dns, but for a single Docker machine. DockRoute watches your running containers, reads dockroute.* labels and reconciles the matching DNS records (and Cloudflare Tunnel routes) in a pluggable provider.

It never alters what it cannot prove it manages: every record it creates gets a companion TXT ownership record, and anything without that proof is logged and skipped.

Setup

Leave DOCKROUTE_PROVIDER=log for a zero-credential dry run, or set it to cloudflare and fill in CLOUDFLARE_API_TOKEN. Socket permissions are handled automatically — the entrypoint grants the app user the socket's group and drops privileges.
Opt containers in with labels:

services:
  whoami:
    image: traefik/whoami
    labels:
      dockroute.enabled: "true"
      dockroute.hostname: "whoami.example.com"
      # optional — publish through an existing Cloudflare Tunnel:
      dockroute.tunnel.service: "http://whoami:80"

Full label and configuration reference: https://www.dockroute.dev