LXD uses dnsmasq to provide DHCP and DNS for containers I think? Viable container escape?