[Unit]
# Disable DNS listener - dnsmasq handles DNS+DHCP on bridge
# Even localhost-only listening blocks dnsmasq from binding to port 53
ConditionVirtualization=!container