Every time you search on Google, Bing, or DuckDuckGo, they know what you typed, when you typed it, and often who you are. They build a profile from your queries and use it to show you ads, personalized results, or sometimes hand it over to third parties. I got tired of that, so I set up my own private search engine at home. In this post, I will walk you through exactly how I did it with SearXNG and Docker Compose, why it is one of the best things you can do for your privacy, and how to harden the setup so it runs clean and secure.
What is SearXNG?
SearXNG is a free, open-source metasearch engine. Instead of crawling the web itself, it sends your query to multiple search engines (Google, Bing, DuckDuckGo, Brave, Wikipedia, and over 270 others) and aggregates the results. The key difference is that SearXNG strips all tracking data before forwarding your request. No cookies, no fingerprinting headers, no referral URLs. The search engines see a clean, anonymous request coming from your server's IP, not from you.
SearXNG is a community-driven fork of the original searx project, started in mid-2021. It is actively maintained, supports 58 languages, and works over Tor if you need that extra layer. For more on anonymous browsing in general, check out How I Browse Anonymously in 2026.
Why self-host instead of using a public instance?
Public SearXNG instances are great for trying it out, but there are real reasons to run your own:
You control the logs. With a public instance, you have to trust the admin. You do not know if they are logging your queries, selling data, or getting pressured by someone. With your own instance, you decide what gets logged and what does not.
No rate limiting or CAPTCHAs. Public instances get hammered by bots, so search engines often block their IPs or throw CAPTCHAs. Your private instance gets clean results because it only handles your traffic.
Your settings persist locally. On public instances, your preferences are stored in cookies. Clear them and everything resets. On your own instance, settings are saved server-side and only you access them.
Full control over which engines are used. You can enable or disable specific search engines, set defaults, and customize the results layout to your liking.
The docker-compose setup
Here is the Docker Compose file I use. It includes SearXNG for search and Redis for rate limiting and caching. Both services are hardened with minimal Linux capabilities and restricted filesystem access.
version: "3.7"
services:
redis:
container_name: redis
restart: unless-stopped
image: redis:alpine
command: redis-server --save 30 1 --loglevel warning
volumes:
- redis-data:/data
cap_drop:
- ALL
cap_add:
- SETGID
- SETUID
- DAC_OVERRIDE
searxng:
container_name: searxng
restart: unless-stopped
image: searxng/searxng:latest
user: "977:977"
ports:
- "8080:8080"
volumes:
- ./searxng:/etc/searxng:ro
- searxng-data:/var/cache/searxng:rw
environment:
- SEARXNG_BASE_URL=http://localhost:8080/
- GRANIAN_NO_ACCESS_LOG=true
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
read_only: true
tmpfs:
- /tmp
- /run
security_opt:
- no-new-privileges:true
logging:
driver: "json-file"
options:
max-size: "100k"
max-file: "1"
volumes:
redis-data:
searxng-data:
This setup runs SearXNG directly on port 8080, which is perfect for local use on your home network.
The settings.yml file
Create a searxng folder next to your docker-compose.yaml and add a settings.yml file inside it:
use_default_settings: true
general:
debug: false
server:
image_proxy: true
limiter: true
log_level: CRITICAL
secret_key: CHANGE_ME_GENERATE_WITH_openssl_rand_hex_32
search:
autocomplete: duckduckgo
formats:
- html
- json
redis:
url: redis://redis:6379/0
ui:
query_in_title: false
static_use_hash: true
The secret_key is used to sign session cookies and prevent tampering. Generate a strong one with:
openssl rand -hex 32
Paste the output into the secret_key field.
Why this compose is hardened for security
Let me break down the security decisions in this setup because they are not random. Each one serves a purpose.
Capability dropping (cap_drop and cap_add)
Every container starts with ALL Linux capabilities dropped, then only the minimum required ones are added back. This follows the principle of least privilege. For example, the SearXNG container only gets CHOWN, SETGID, and SETUID, which it needs to run its web server process. It cannot mount filesystems, change network settings, or do anything else the kernel would normally allow a privileged process to do.
Read-only filesystem
The SearXNG container runs with read_only: true. This means the container's root filesystem cannot be modified at runtime. Even if someone exploited the application, they could not write malicious files to disk. Only /tmp and /run are mounted as temporary filesystems (tmpfs) for the application's runtime needs.
No new privileges
The no-new-privileges: true security option prevents any process inside the container from gaining additional privileges through setuid/setgid binaries or other escalation techniques. This blocks a whole class of privilege escalation attacks.
Non-root user
SearXNG runs as user 977:977, not as root. If the application is compromised, the attacker operates with limited permissions and cannot affect the host system or other containers.
Minimal logging
The logging driver is set to JSON with a max file size of 100KB and only 1 file. This means old logs are automatically rotated and you never fill up your disk. The GRANIAN_NO_ACCESS_LOG=true environment variable disables access logging entirely, so search queries are not written to disk. The log_level: CRITICAL in settings.yml means SearXNG only logs actual errors, not routine operations.
Redis with minimal persistence
Redis is configured to save data every 30 seconds (only if there was at least 1 write), with warning-level logging. It stores rate limiter data and cached results, nothing more. If the container restarts, the cache is rebuilt automatically.
Step-by-step deployment
1. Create the project directory
mkdir -p ~/searxng-docker/searxng
cd ~/searxng-docker
2. Generate a secret key
openssl rand -hex 32
3. Create the settings file
Save the settings.yml from above into the searxng folder:
nano searxng/settings.yml
Paste the configuration and replace CHANGE_ME_GENERATE_WITH_openssl_rand_hex_32 with your generated key.
4. Create the docker-compose file
Save the compose file from above into the project root:
nano docker-compose.yaml
5. Start the stack
docker compose up -d
6. Verify it is running
docker ps --filter name=searxng
You should see the container running. Open http://localhost:8080 in your browser on the same machine, or use http://<your-server-ip>:8080 from any other device on your local network. For example, if your server is at 192.168.1.50, just go to http://192.168.1.50:8080 and start searching.
How SearXNG protects your privacy technically
Here is what happens under the hood when you run a search through your self-hosted SearXNG:
No cookies are sent to search engines. SearXNG strips all cookies before forwarding your query. Google, Bing, and others cannot link your search to a previous session.
Random browser profile per request. Each outgoing request uses a randomized User-Agent and browser fingerprint. This prevents search engines from building a consistent profile of your device.
No referral headers. When you click a search result, SearXNG hides the referrer. The destination website does not know you came from a search or what you searched for.
Image proxy. The
image_proxy: truesetting routes all thumbnail images through your SearXNG instance instead of loading them directly from external servers. This prevents image hosts from seeing your IP or setting tracking cookies.Rate limiter. The built-in rate limiter (backed by Redis) protects your instance from abuse if you ever expose it to others. It prevents automated scraping while keeping normal use fast.
Your IP is the only thing visible. Search engines see the IP of your server, not your personal device. If your server is on your home network behind NAT, they see your home IP. If you put it behind a VPN or VPS, they see that IP instead.
Tips for getting the most out of your instance
Set it as your default search engine in Firefox. Go to Settings, Search, and add your SearXNG instance URL with
/?q=%sas the search string. Now every search goes through your private instance.Enable the JSON format. The
formats: [html, json]setting in settings.yml allows browser extensions and other tools to use your instance as an API. This is useful if you want to integrate private search into other applications.Use the bang syntax. SearXNG supports bang shortcuts like
!gfor Google,!wfor Wikipedia, and!ddgfor DuckDuckGo. Type!g your queryto search directly on Google through your SearXNG instance (still anonymized).Customize your engines. In the SearXNG web UI, click Preferences, then Engines. Disable any search engines you do not want and set your preferred defaults.
Keep it updated. Run
docker compose pull && docker compose up -dperiodically to get the latest SearXNG version with new engine support and security patches.
How to access your SearXNG instance remotely
Running SearXNG on your home network is great, but what if you want to use it from outside your house? Here are three solid options, each with different trade-offs.
Cloudflare Tunnel (easiest for public access)
Cloudflare Tunnel lets you expose your local SearXNG to the internet without opening any ports on your router. You install cloudflared on the same machine, create a tunnel, and point a domain at it. Cloudflare handles HTTPS automatically. This is the easiest way to make your instance accessible to family members or use it from any device anywhere.
Tailscale (best for personal remote access)
Tailscale creates a private mesh network between your devices. Install it on your SearXNG server and your phone or laptop, and you can access http://<tailscale-ip>:8080 from anywhere as if you were on the same local network. No port forwarding, no domain needed. This is what I recommend if only you need remote access. If you want to understand more about personal VPNs and when they make sense, read Do You Really Need a VPN in 2026?.
WireGuard (best for full network access)
WireGuard is a fast, modern VPN. If you already run a WireGuard server on your home network, you can connect to it and access SearXNG at http://<server-ip>:8080 just like you would at home. It gives you access to your entire home network, not just SearXNG.
All three options keep your SearXNG instance private. No random strangers can find it or abuse it. You stay in control.
Need help setting this up?
If you want a private search engine running in your home or business but do not want to deal with the setup yourself, I can handle it for you. From Docker deployment to security hardening and remote access configuration, I offer hands-on help for people who want things done right the first time. Reach out through the contact page and let us talk about your setup.
Frequently asked questions
Is SearXNG legal to use?
Yes, completely. SearXNG is open-source software licensed under the AGPL. It queries public search engines the same way a browser does. Self-hosting it is no different from using any other search engine.
Does SearXNG work with Google?
Yes. SearXNG includes Google as one of its 274 supported engines. Your queries go to Google through SearXNG, so Google sees your server's IP instead of yours and receives no cookies or tracking data.
Can I use SearXNG without Docker?
You can install it directly on Linux, but Docker is the easiest and most isolated way to run it. The compose file above sets up everything in minutes with proper security hardening. If you are wondering whether self-hosting is worth the effort in general, I wrote about that in When Self-Hosting Is Worth It.
Will my search results be as good as Google?
SearXNG aggregates results from multiple engines, so you often get better and more diverse results than any single engine alone. If one engine blocks or rate-limits, others still return results.
How much resources does SearXNG need?
Very little. The entire stack (SearXNG and Redis) uses around 80-120MB of RAM. It runs fine on a Raspberry Pi, a small VPS, or any home server.
Can I share my instance with family or friends?
Yes. Just give them the URL (and a VPN or password if you want to restrict access). The rate limiter prevents abuse, and you control the logs.