Hardened Pi-hole, AdGuard Home & DNS Server

This is a repackaged open source software product wherein additional charges apply for security hardening, secure-by-default configuration and per-instance setup.

What cloudimg adds to every version

• Every image is built by cloudimg on a fully patched base with the latest security updates applied at build time.
• Where a product has a login, API key or TLS key (web consoles, DNS-over-TLS, NTS, rndc), it is generated uniquely on the first boot of each instance and written to a root-only file, so no default login exists and no two instances share a secret.

Included products

• AdGuard Home 0.107.79 with Unbound: network-wide ad and tracker blocking with a web console
• AdGuard Home 0.107.79: network-wide ad and tracker blocking with a web console
• BIND 9.20.29: authoritative and recursive DNS (ISC BIND 9)
• Chrony 4.5: NTP time server and client
• CoreDNS 1.14.7: a pluggable DNS server
• DDNS Updater 2.10.0: keeps dynamic DNS records current
• ntpd-rs 1.9.0: an NTP server with NTS, written in Rust
• Pi-hole 6.5: network-wide ad blocking DNS
• Poweradmin 4.3.5: a web panel for PowerDNS Authoritative Server
• PowerDNS Recursor 5.4.7 + dnsdist: a recursive resolver with dnsdist for DNS-over-TLS and HTTPS
• SmartDNS 48.4: a fast local DNS resolver
• Unbound 1.19.2: a validating, recursive, caching resolver
• Zonemaster 2026.1.2: tests a zone's DNS delegation

How to choose a version

• Network-wide ad blocking: Pi-hole or AdGuard Home (with Unbound for private recursive lookups)
• A recursive resolver for your VPC or VPN: Unbound, PowerDNS Recursor with dnsdist, or SmartDNS
• Authoritative DNS for your zones: BIND, CoreDNS or Poweradmin
• Accurate time for your fleet: Chrony or ntpd-rs (with NTS)
• Check a zone's delegation: Zonemaster; keep a dynamic DNS record current: DDNS Updater

Network and access defaults

• DNS, DNS-over-TLS and NTP ports stay closed in the security group until you open them to your own VPC or VPN ranges, and resolvers answer only loopback and private networks by default, so an instance is never an open resolver.

This listing is a collection of separate AMIs, one per product and version, chosen from the Software version dropdown at launch.

Support

cloudimg provides 24/7 technical support for every version in this listing by email and live chat, 365 days a year, with a 24-hour response SLA: support@cloudimg.co.uk.

Trademarks

Pi-hole, AdGuard Home and the other product names are trademarks of their respective owners. cloudimg is not affiliated with or endorsed by any of them.