I found evidence the Ziti nameserver tries to start when tunnel mode is "host." If the PID has permission to bind low ports like 53 it will succeed unnecessarily binding the UDP socket, but fails with an error message if it lacks permission.
This tells me two things:
ziti router run has a defect that causes it to bind port 53 when tunneling mode isn't tproxy (link to GitHub issue).- Your router is running with unnecessarily elevated permissions, e.g., as root. If you remove privileges and manage file owner and mode accordingly, then the router will be unable to bind 53/udp and create the conflict with the Pi Hole nameserver.
I see from the thread you used the expressInstall function to generate a temporary, local controller and router configuration.
You can inspect the path to the router's system-wide service unit to see the User directive, if any:
systemctl cat ziti-router.service
Since you're working with a temporary, local quickstart, you may wish to run the router as your login user instead of root. You can accomplish this by moving the service unit file from the system-wide location reported by the systemctl cat command to your user's systemd namespace.
For example,
Create the systemd user directory if necessary.
mkdir -pv ~/.config/systemd/user
Move the system-wide service unit.
sudo mv /lib/systemd/system/ziti-router.service ~/.config/systemd/user/ziti-router.service
Grant your login user permissions on the router's current working directory and systemd units directory.
sudo chown -Rc $(id -u) /home/amackenzie/.ziti/quickstart/cirno ~/.config/systemd/user/
sudo chmod -Rc u+rwX /home/amackenzie/.ziti/quickstart/cirno ~/.config/systemd/user/
Edit the moved file to delete the User=root directive.
vi ~/.config/systemd/user/ziti-router.service
Reload all systemd units from the disk.
sudo systemctl daemon-reload
systemctl --user daemon-reload
Now the router is running as your login UID and does not have permission to bind 53/udp, which causes an "error" message like the below that has no effect on tunnel mode "host."
{
"error": "dns server failed to start: listen udp 127.0.0.1:53: bind: permission denied",
"file": "github.com/openziti/ziti/router/xgress_edge_tunnel/tunneler.go:75",
"func": "github.com/openziti/ziti/router/xgress_edge_tunnel.(*tunneler).Start",
"level": "error",
"msg": "failed to start DNS resolver. using dummy resolver",
"time": "2024-10-14T09:05:16.665Z"
}
Monitor the relocated service unit's log.
journalctl --user -lfu ziti-router.service