dnsmasq admits a query by the interface it arrives on when told interface=, and by the address it is sent to when told listen-address=. A container's query is sent to the machine's private address but arrives on docker0, so interface=mesh0 dropped it silently on every machine (novox/hq issue 110). Name the address, not the interface.