How to Enable DNS over HTTPS in Docker Containers for InternetIncome

Enable DNS over HTTPS in InternetIncome by setting USE_DNS_OVER_HTTPS=true in properties.conf, which switches the proxy tunnel from tun2socks to tun2proxy and appends the --dns over-tcp flag to encrypt DNS queries.

The InternetIncome script by engageub/internetincome orchestrates multiple income-generating applications inside isolated Docker containers. By default, the script configures containers to use standard public DNS resolvers, but you can enable DNS over HTTPS (DoH) to encrypt DNS queries and prevent ISP snooping. This guide explains the implementation details found in internetIncome.sh and how to activate the feature.

Understanding the DNS over HTTPS Implementation

When USE_DNS_OVER_HTTPS is enabled, the script fundamentally changes how the proxy tunnel container handles DNS resolution. Instead of using the default tun2socks image, the script pulls and runs tun2proxy (version v0.7.19) from ghcr.io/tun2proxy/tun2proxy.

The tun2proxy container intercepts all DNS queries from application containers and forwards them over HTTPS to upstream resolvers. This is achieved by passing the --dns over-tcp argument to the container at runtime, which forces DNS resolution through the encrypted tunnel rather than cleartext UDP.

Configuring DNS over HTTPS in properties.conf

To enable the feature, you must edit the properties.conf file in the repository root. Set the boolean flag to true and ensure conflicting options are disabled.

# properties.conf

USE_DNS_OVER_HTTPS=true
USE_SOCKS5_DNS=false

The script checks this variable during initialization. If USE_DNS_OVER_HTTPS equals true, the logic branch starting at line 208 in internetIncome.sh executes, overriding the default tunnel behavior.

How the Script Implements DNS over HTTPS

The orchestration logic in internetIncome.sh handles image selection, container creation, and DNS option injection through several distinct steps.

Detecting the Configuration Flag

At lines 208–216, the script evaluates the USE_DNS_OVER_HTTPS environment variable. When true, it sets the TUNNEL_IMAGE variable to the tun2proxy registry path and defines the DNS_OPTION string.

elif [ "$USE_DNS_OVER_HTTPS" = true ]; then
    sudo docker pull ghcr.io/tun2proxy/tun2proxy:v0.7.19
    TUNNEL_IMAGE="ghcr.io/tun2proxy/tun2proxy:v0.7.19"
    DNS_OPTION="--dns over-tcp"

Running the Tunnel Container with DoH

At lines 250–258, the script launches the tunnel container using the variables defined above. The --dns over-tcp flag is appended to the container command, ensuring all DNS queries from connected application containers are routed through the HTTPS resolver.

sudo docker run -d \
  --name tun$(openssl rand -hex 4) \
  --cap-add=NET_ADMIN \
  --restart=always \
  --mount type=bind,source=$(pwd)/resolv.conf,target=/etc/resolv.conf,readonly \
  $TUNNEL_IMAGE $DNS_OPTION

Fallback DNS Configuration

Before any containers start, the script generates a fallback resolv.conf at lines 46–50. This file contains public DNS servers (8.8.8.8, 1.1.1.1) and is mounted into every container. If the tun2proxy container fails or is unreachable, containers can still resolve names using this fallback, preventing startup failures.

Verifying DNS over HTTPS is Active

To confirm that DNS queries are encrypted, inspect the running tunnel container and test resolution from within an application container.

First, verify the tunnel is using the correct image and flags:

docker ps --filter "ancestor=ghcr.io/tun2proxy/tun2proxy:v0.7.19" --format "table {{.Names}}\t{{.Command}}"

You should see the --dns over-tcp argument in the command column.

Next, execute a DNS lookup from inside any running income container (e.g., EarnApp):

docker exec -it earnapp$(cat containernames.txt | head -n1) sh -c "nslookup cloudflare.com"

If the query returns results and the tunnel logs (viewable via docker logs <tunnel_name>) show TCP DNS forwarding, DoH is active. The tun2proxy image routes these TCP DNS requests over the HTTPS tunnel to the upstream resolver.

Summary

• Enable DoH by setting USE_DNS_OVER_HTTPS=true in properties.conf before starting the script.
• Image switch: The script replaces the default tun2socks tunnel with ghcr.io/tun2proxy/tun2proxy:v0.7.19 when the flag is enabled.
• DNS encryption: The --dns over-tcp flag forces DNS queries through the HTTPS tunnel, preventing cleartext UDP leaks.
• Fallback safety: A static resolv.conf (8.8.8.8, 1.1.1.1) is mounted into all containers as a backup if the tunnel fails.
• Verification: Check running containers for the tun2proxy image and test DNS resolution from within app containers to confirm encryption is active.

Frequently Asked Questions

What is the difference between tun2socks and tun2proxy in InternetIncome?

tun2socks is the default tunnel image used when USE_DNS_OVER_HTTPS is disabled or set to false. It routes traffic through a SOCKS5 proxy but does not inherently encrypt DNS queries. tun2proxy is the specialized image pulled when USE_DNS_OVER_HTTPS=true; it supports the --dns over-tcp flag, which tunnels DNS queries over HTTPS, providing encryption and preventing ISP-based DNS snooping.

Can I use DNS over HTTPS with SOCKS5 DNS enabled?

No, these options are mutually exclusive. The script logic in internetIncome.sh checks USE_DNS_OVER_HTTPS first; if set to true, it configures the tun2proxy container with --dns over-tcp. You must set USE_SOCKS5_DNS=false in properties.conf to avoid conflicts, as both settings attempt to control DNS resolution behavior within the tunnel container.

How do I verify that DNS queries are encrypted?

To verify, first confirm the tunnel container is running the correct image with docker ps and check that the command includes --dns over-tcp. Then, execute nslookup or dig from within any application container (e.g., docker exec -it <container_name> nslookup example.com). If the query succeeds while the tunnel logs show TCP-based DNS forwarding, and no cleartext UDP DNS traffic is visible on port 53, DNS over HTTPS is active.

What happens if the tun2proxy container fails to start?

If the tun2proxy container fails, the InternetIncome script has a fallback mechanism. Before launching any containers, it generates a static resolv.conf containing public DNS servers (8.8.8.8 and 1.1.1.1) and mounts this into every application container. This ensures that even if the encrypted tunnel is unreachable, containers can still resolve domain names and start successfully, though without the privacy benefits of DNS over HTTPS.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}