# The resolver the SANDBOX's network sees. Not the host's.
#
# SLIRP gives every guest 10.0.2.3 as its nameserver via DHCP. That is a
# forwarder inside the qemu process, and it relays to whatever the HOST's
# /etc/resolv.conf says - which here is 127.0.0.53, systemd-resolved,
# which forwards to the LAN's own DNS servers and knows every internal
# name in the house.
#
# The sandbox denies 127.0.0.0/8, correctly, so that relay is dead: a
# guest that takes DHCP gets working TCP to the internet and no name
# resolution at all, which presents as "no internet" and sends people
# looking in the wrong place.
#
# systemd bind-mounts this file over /etc/resolv.conf inside the VM
# unit's mount namespace, so the forwarder relays HERE instead. The guest
# needs no configuration, the host's resolver is still never reachable
# from the sandbox, and nothing internal is ever asked about.
nameserver 1.1.1.1
nameserver 9.9.9.9