Running Pi‑hole on k3s and how GenAI tried to make me run as root

I was wrestling with Pi‑hole on single node Kubernetes and hit the classic privileged‑port problem: DNS wants port 53, containers don’t. The first GenAI suggestions were blunt, run the container as root. After some challenging from my side, it pivoted to MetalLB which is a nice option in a multi node setup. After digging I discovered a much cleaner path: k3s’s built‑in load balancer (ServiceLB, formerly known as Klipper LoadBalancer). Configure Pi-hole to use port 5353 and map it to 53 at the ServiceLB, no root, no extra components, and it worked like a charm.