Most Docker Apps can't get to internet - looks like DNS issues but can't figure out

posted this in general support but no real luck so hopefully find some here, added some additional details also :-).

Been having some networking issues off / on since before the 7.0 upgrade, but seems to be worse now. Originally i was having issues connecting to unraid connect, the CA wasn't working properly to detect updates. doing the unraid-api restart command seemed to resolve it sometimes or maybe for 5 minutes then back... my containers all still seemed to work fine and i didn't notice any problems with their connectivity. 

For the last week or so i've been having issues where the containers are unable to connect to internet. For the ones that have ping command available they show a name resolution error. When this came up last week i found some articles pointing to turn off enable host access to custom network, do a force update, try again. Some variation of that did work for me eventually. I believe the last thing i did was to set them to host networking, spin them up, they connected, set them back to my custom network IP and then start and they all just worked. until last night.... 

I've done similar steps today, turned off the enable host access to custom network and tried again. no change. set to host network for the container and they work fine, when i go back to my custom network and the designated ip they start up fine but don't connect. i've also wiped out and rebuilt the docker image file with just a handful of the applications restored while i try and work through this, no improvement. I've run this ipvlan network for 2-3 years now mostly without issue once i understood how it worked, not sure what's going on now and how to troubleshoot next. 

I do run an unbound container to provide dns but as part of the troubleshooting here i pointed all the vlans to just use automatic dns from my net provider and bypass my dns. also have tailscale running on this in case that matters - my primary container i access via tailscale is still accessible remotely so it seems fine

high level overview of my network is i have containers on different vlan's - most on the same subnet as the host server (.10.x), i have my omada container on the same vlan as the networking gear (.1.x) I do have 2 nics in the server and one goes to each subnet. Containers on both subnets are having problems. but not all of the containers have this problem... If i set omada to use host network, i can get to internet and it all works, as soon as i set back to custom network it doesn't. 

diagnostics attached. suggestions appreciated.

rlyeh-diagnostics-20250204-1631.zip