Bottom Line: Do Not Make ZimaOS Depend on an AdGuard Container Running on the Same ZimaOS Host for Its Only DNS Resolver
The update failed for a predictable reason: ZimaOS needed DNS to pull the new AdGuard image, but its only configured DNS server was the AdGuard container being restarted/replaced. That creates a circular dependency. A second DNS field would improve resilience, but the architecture should not rely on the service being updated to resolve the update server.
Current ZimaOS Documentation Still Describes a Single Manual DNS Server Field
The September 2026 ZimaOS network configuration guide describes Manual mode as IP address, subnet mask, gateway and DNS server in the singular. The public guide does not currently document multiple GUI DNS entries, so do not assume the 2025 feature request has been implemented.
Use an Independent Resolver for the ZimaOS Host
A clean design is:
- ZimaOS host → router/ISP/Cloudflare/another independent resolver.
- LAN clients → AdGuard Home for filtering.
- AdGuard upstream → the resolvers you trust.
This means AdGuard can restart or upgrade without taking away the host's ability to resolve Docker registries and remote services.
The AdGuard Home hardware guide covers the app role, while the Pi-hole DNS guide reinforces the same separation between client DNS filtering and host infrastructure dependencies.
Secondary DNS Is Not Always Strict Failover
Many operating systems and resolvers may query multiple configured DNS servers rather than treating the second as “only if the first is dead.” So if every client must be filtered, giving clients a public resolver as secondary can allow some queries to bypass AdGuard. Put redundancy behind the filtering layer or keep the independent resolver only on infrastructure hosts.
Public Resolver References
Cloudflare documents its 1.1.1.1 resolver addresses, and Google documents Google Public DNS configuration. Use whichever matches your privacy, filtering and availability requirements.
Quick Test Before Updating a Local DNS Container
nslookup registry-1.docker.io
nslookup github.comThen stop the AdGuard container temporarily and repeat the lookup from the ZimaOS host. If DNS dies, the host still has a circular dependency that can break the next DNS-container update.
