Authoritative dnsmasq in a MikroTik container

Summary

Georg Lukas, 2026-07-26 19:24 This post is about setting up and configuring a dnsmasq container on a MikroTik RouterOS device to be used as an authoritative DNS server and a forwarding cache at the same time. Introduction Recently I joined DN42, a world-wide overlay network created for experimenting with IP routing and for connecting communities, hack-spaces, and networking nerds who are not allowed 😜 to break the real Internet. I wanted to play on hard mode, so I configured the DN42 tunnels in a VRF on my home lab switch, a MikroTik RB4011. And of course I wanted to provide authoritative DNS for my .dn42 zone from the same switch. MikroTik routers come with a built-in DNS service, but it can't act as an authoritative server, and there is a shared DNS cache for all clients, which would leak my home lab to DN42. I already run prosody and iperf on my switch, so the "obvious" "solution" was to add another container. MikroTik Containers MikroTik routers with ARM and ARM64 CPUs support Docker containers. The manufacturer strongly recommends using external USB / SD card storage to not wear out internal flash. Ignoring that recommendation might cause the flash in your router to fail and turn the router into an expensive paperweight. The RB4011 doesn't have USB or SD ports, and adding NVMe looks complicated. It is possible to use the Storage package to mount remote disks, but I hate circular dependencies between my devices. Then again, people reports millions of flash writes, so I'm going to YOLO my containers on the internal 512MB flash, using /docker for the images and volumes. Nevertheless, if you look for a MikroTik router to run containers, maybe pick one with ARM64 and a physical storage port. Enabling containers requires a walk to the switch to ensure physical presence, and will increase your attack surface. Then we can configure it to fetch from Docker Hub, which gives us access to some 117k ARM images: /container config set registry-url=https://registry-1.docker.io...