The portal reverse proxies hardcoded Docker's embedded DNS (resolver 127.0.0.11); on rootless
podman the DNS is network-specific (aardvark), so every proxied BFF call 502'd. Add an
/docker-entrypoint.d hook that rewrites the resolver from the container's /etc/resolv.conf at
startup — a no-op on Docker (nameserver IS 127.0.0.11), correct on podman. Verified: the built
image rewrites to 10.89.0.1 and /behandel/werkbak proxies to the BFF (401, not 502).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
