$ ls ./proxmox
A dead resolver from a Tailscale experiment months ago kept leaking into brand-new containers, breaking DNS resolution in ways that look like an app bug. Here's how it propagates and the two ways to catch it.
Group membership doesn't save you here — unprivileged LXC UID remapping means the container sees your bind-mounted device as nobody:nogroup. What actually grants access, and the two config lines that do it.
ip neighbor show only reflects hosts that have talked recently. An absent ARP entry does not mean an IP is free — here's why that matters and the one-line check that actually proves it.
Why files bind-mounted into an unprivileged Proxmox LXC show up as nobody:nogroup, and how to fix it properly with subuid/subgid mapping instead of going privileged.