I run an instance of it in a VM since it's a nice, lazy, well-maintained way to run unbound as recursive DNS with a pretty UI.
All my clients use the router (dnsmasq) as their DNS, which has a smaller ~20,000 domain hostsfile. So most bad queries don't make it to the pihole.