Using Container Manager (Docker) on your Synology

Container Manager is Synology’s own Docker implementation — on older DSM versions the package was still called “Docker”, on DSM 7.2+ it’s Container Manager (based on Docker Engine, identical commands). It lets you run your own applications as containers on your Synology.

Classic use cases: Pi-hole (DNS filter), Home Assistant (smart home hub), Vaultwarden (Bitwarden server), Plex/Jellyfin (media server), Nextcloud (if you don’t want our managed version), Wireguard (VPN), Adguard Home — the list is long.

Requirement: Plus models (DS225+, DS925+, DS1625+) support Container Manager. The simpler Value models don’t — Docker won’t run on those.

Install Container Manager

1. Package Center → search for “Container Manager” → Install.
2. Switch to the app after installation.

You’ll see four tabs:

• Overview: running containers at a glance
• Container: all containers, with actions (start, stop, logs)
• Image: Docker images available locally
• Registry: browse Docker Hub and other registries

Plus a fifth section, Project, for Docker Compose stacks (see below).

First container — Pi-hole as an example

Pi-hole as a DNS filter for ad- and tracker-blocking DNS on your home network. Classic example.

Via Docker Compose (the recommended way):

1. In Container Manager: Project → Create.
2. Project name: pihole.
3. Path: /docker/pihole (Synology creates it automatically).
4. Source: Create YAML.

Contents of the docker-compose.yml:

version: "3"
services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "8080:80/tcp"
    environment:
      TZ: "Europe/Berlin"
      WEBPASSWORD: "DEIN-PASSWORT"
    volumes:
      - "/volume1/docker/pihole/etc-pihole:/etc/pihole"
      - "/volume1/docker/pihole/etc-dnsmasq:/etc/dnsmasq.d"
    restart: unless-stopped

Save, Apply. Container Manager pulls the Pi-hole image and starts the container.

You’ll then reach the Pi-hole web interface on port 8080 — http://<your-synology-ip>:8080/admin.

Via the GUI without Compose

If you don’t want to write a YAML file:

1. Image → Add → From URL → pihole/pihole:latest.
2. After the download: select the image → Run.
3. In the wizard: enter container name, port mapping, volume mounts and environment variables one by one.

More click-heavy, but it works. For more complex stacks, Compose is considerably clearer.

Pitfalls we see often

Port conflicts: DSM uses a few standard ports (5000, 5001, 80, 443). If your container wants the same ports: conflict. Solution: map the container to different ports (e.g. 8080:80 instead of 80:80).

Wrong volume paths: Synology mounts volumes differently from standard Linux. Paths are /volume1/..., not /mnt/.... Pay close attention in Compose files.

“Host” network mode: some containers need host networking (Pi-hole without a custom DNS bind, for example). That works on Synology but is tricky. In Container Manager under Advanced Settings → Network → Bridge or Host.

Keep an eye on RAM usage: containers eat RAM. A Synology with 2 GB of RAM (DS225+) can handle 3–5 lightweight containers, not much more. Watch RAM usage in the Resource Monitor in DSM.

Updates aren’t automatic: Container Manager doesn’t update images on its own. For auto-updates, run a Watchtower container alongside, or manually re-pull images every few weeks.

Best-practice setup for your own containers

Volume structure for container data:

/volume1/docker/
├── pihole/
│   ├── etc-pihole/
│   └── etc-dnsmasq/
├── homeassistant/
│   └── config/
└── vaultwarden/
    └── data/

One subfolder per container — everything that persists goes into the mount path. For backups, simply include /volume1/docker/ in Hyper Backup — with our Hyper Backup Storage as the target, for example.

Reverse proxy for external access: in DSM under Login Portal → Reverse Proxy you can route subdomains (say vault.deinname.de) to container ports. With a Let’s Encrypt certificate, HTTPS then works automatically.

A backup layer for running databases: Postgres or MySQL containers need a dump before the backup, otherwise the backups are inconsistent. Write regular dumps to the mount folder via Compose or a cron job.

Docker Hub — careful when pulling images

You’ll find thousands of images on Docker Hub. From our experience:

• Prefer official images (the “official” tag, or from the project’s own organization).
• Avoid unknown packages: an image from “supercoolusername” without a repo link can contain malware.
• Pin to specific versions: the :latest tag is convenient, but it can change behind your back. :1.4.2 is safer.

Trustworthy sources for private customers:

• LinuxServer.io (lscr.io) — many well-maintained images
• Home Assistant Community (HACS)
• Official project repos

Containers in the DSM overview

Container Manager shows:

• Status: running / stopped / error
• CPU and RAM usage live
• Logs: container output, scrollable — important for debugging
• Terminal: open a shell inside the container (for bash debugging)
• Actions: start, stop, restart, delete

Frequently asked questions

What’s the difference compared to Docker on a vServer? Functionally identical. Container Manager is Synology’s GUI on top of Docker Engine, all standard Docker features are included. Synology’s advantage: simple GUI, integrated volume and backup management. vServer’s advantage: more CPU/RAM for demanding containers.

Does Docker Compose v3 work? Yes. Container Manager on DSM 7.2+ supports Compose v3 — most common Compose files run out of the box.

Can I run a GitHub Actions self-hosted runner as a container? Yes, some customers do. Note: the runner only needs an outbound HTTPS connection to GitHub, no open inbound ports.

Can I make containers reachable from outside? Via the reverse proxy in DSM (see above). Direct port mapping to the outside works too — then the firewall rule has to match, and the container ports are directly reachable from the internet.

What about Apple Silicon (ARM) — do all containers run? Synology Plus models use x86_64 architecture. Containers that only have ARM images won’t run. With multi-arch images (most popular ones), it doesn’t matter — Docker automatically pulls x86_64.

How many containers can I run in parallel? Depends on RAM and CPU. A DS225+ with 2 GB of RAM: 3–5 lightweight containers. A DS925+ with 4 GB of RAM: 8–12. With a RAM upgrade to 16 or 32 GB, considerably more.

What if a container corrupts data? Hopefully you have Hyper Backup running — then you can restore the data mount folder. Snapshot Replication on the volume helps too (see Snapshot Replication).

What’s next

• Snapshot Replication for version protection
• Set up a Let’s Encrypt certificate