$ ls ./lxc
A dead resolver from a Tailscale experiment months ago kept leaking into brand-new containers, breaking DNS resolution in ways that look like an app bug. Here's how it propagates and the two ways to catch it.
Group membership doesn't save you here — unprivileged LXC UID remapping means the container sees your bind-mounted device as nobody:nogroup. What actually grants access, and the two config lines that do it.
Why files bind-mounted into an unprivileged Proxmox LXC show up as nobody:nogroup, and how to fix it properly with subuid/subgid mapping instead of going privileged.