A module's settings merge into every mergeable file it owns, so the setting reached docker's daemon.json beside dnsmasq's config, where dockerd would refuse it (novox/hq issue 198). Back to the fixed loopback line until settings can be kept out of files they are not for.