#debugging

dnsmasq answers on the interface, not on the address

The gateway pings from inside the container and its DNS never answers. I got the diagnosis wrong twice, and the second time it was my own test that was lying.