Here’s how to schedule your AdGuard Home container to run automatically on boot using a Quadlet file—no manual enabling required. These steps assume you’re on Fedora CoreOS as of December 2025, with a recent Podman version.

Step 1: Create the Quadlet File

Fedora CoreOS uses /etc/containers/systemd/ for Quadlet files, which define containers as systemd services. Let’s create adguardhome.container:

sudo nano /etc/containers/systemd/adguardhome.container

Paste this (modify the network info with yours; AdGuard Home has a setup wizard for passwords and other configs):

[Unit]
Description=AdGuard Home Container
After=network-online.target
Wants=network-online.target

[Container]
ContainerName=adguardhome
Image=docker.io/adguard/adguardhome:latest
AutoUpdate=registry
Network=host
AddCapability=NET_ADMIN
Environment=TZ=America/Chicago
Volume=adguardhome_work:/opt/adguardhome/work:Z
Volume=adguardhome_conf:/opt/adguardhome/conf:Z

[Service]
Restart=always
TimeoutStartSec=900

[Install]
WantedBy=multi-user.target

Save and exit (Ctrl+O, Enter, Ctrl+X in nano).

Step 2: Reload Systemd

Tell systemd to process the Quadlet file with Podman’s quadlet generator:

sudo systemctl daemon-reload

This generates a transient adguardhome.service in /run/systemd/generator/.

Step 3: Start the Container

Kick it off manually the first time:

sudo systemctl start adguardhome.service

Check it’s running:

sudo podman ps -a

You should see your adguardhome container up and humming.

Enable AUTO-UPDATE:

sudo systemctl enable —now podman-auto-update.timer

Step 4: Configure nftables Firewall

For security, we’ll set up a lightweight nftables firewall to control access to AdGuard Home and other services on your Fedora CoreOS host.

Create the Firewall Configuration

Create the nftables configuration file:

sudo nano /etc/nftables.conf

Add the following rules (adjust 192.168.1.0/24 to match your LAN subnet):

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        
        # Allow established connections
        ct state established,related accept
        
        # Allow loopback
        iif lo accept
        
        # Allow DNS from LAN only
        ip saddr 192.168.1.0/24 udp dport 53 accept
        ip saddr 192.168.1.0/24 tcp dport 53 accept
        
        # Allow AdGuard web interface from LAN
        ip saddr 192.168.1.0/24 tcp dport 80 accept
        
        # Allow SSH from LAN only
        ip saddr 192.168.1.0/24 tcp dport 22 accept
        
        # Allow ICMP ping
        icmp type echo-request accept
    }
    
    chain forward {
        type filter hook forward priority 0; policy drop;
    }
    
    chain output {
        type filter hook output priority 0; policy accept;
    }
}

Save and exit (Ctrl+X, Y, Enter).

Test and Apply the Configuration

First, test the configuration for syntax errors:

sudo nft -c -f /etc/nftables.conf

If no errors appear, apply the rules:

sudo nft -f /etc/nftables.conf

Enable Firewall on Boot

Enable the nftables service to load rules automatically on boot:

sudo systemctl enable nftables
sudo systemctl start nftables

Verify the Configuration

Check that your rules are loaded:

sudo nft list ruleset

Test DNS from another device on your network:

nslookup google.com YOUR_COREOS_IP

Your AdGuard Home installation is now secured with a firewall that only allows access from your local network while still permitting system updates and outbound connections.

Step 5: Test Autostart on Reboot

The WantedBy=multi-user.target line ensures AdGuard Home starts on boot. Test it:

sudo reboot

After reboot, verify:

sudo podman ps -a

If adguardhome is running, you’re set—no systemctl enable needed, as Quadlets handle autostart dynamically.

Notes

• Why No enable? Generated services in /run/ are transient and can’t be enabled traditionally. The [Install] section ties it to the boot process instead.

• Tweaks : Older Quadlet guides mention Hostname or RestartPolicy, but these are unsupported now—stick to the basics above.

• Hostname : Defaults to adguardhome from ContainerName. If you need adguard-home, you’d need a custom workaround or a classic systemd service.

• Initial Setup : After starting, access the AdGuard Home web interface at http://your-server-ip:3000 to complete the initial configuration wizard. Set your admin password, upstream DNS servers (e.g., 1.1.1.1), and any other preferences there. Unlike Pi-hole, many settings are handled via the UI rather than environment variables. After the initial setup, your port will change to http://your-server-ip:80

• Volumes : The persistent volumes (adguardhome_work and adguardhome_conf) store your configuration and data. Ensure Podman volumes are created if needed (they’ll be auto-created on first run).

That’s it! Your AdGuard Home is now a proper Fedora CoreOS citizen, managed via Podman Quadlets. Enjoy ad-free browsing!