dnsmasq responds to the client using a UDP broadcast packet on port 68, which does not make it out of the bridged Docker network unless using --net=host.
One workaround is to add a socat listener on the Docker network that forwards to the host:
and then ...
Seems like it was self-induced hell. The whole setup is needed just to work with some environment,requiring catching special names and resolving them into predefined local addresses in 172, which also have to be bound by hand. The latter was done through systemd-networkd via custom file in /etc/systemd/network/; after deleting it everything start working ...