fix: add dnsmasq restart-on-failure override for container boot race

install.sh

@@ -348,6 +348,14 @@ EOF
     log "NAT routing service installed"
 
     # Start/enable dnsmasq
+    # Add restart policy for containers (interface may not be ready on first boot)
+    mkdir -p /etc/systemd/system/dnsmasq.service.d
+    cat > /etc/systemd/system/dnsmasq.service.d/restart.conf << 'EOF'
+[Service]
+Restart=on-failure
+RestartSec=5
+EOF
+    systemctl daemon-reload
     systemctl enable dnsmasq 2>/dev/null || true
     systemctl restart dnsmasq 2>/dev/null || service dnsmasq restart 2>/dev/null || true
     log "dnsmasq restarted"