dnsmasq responds to the client using a UDP broadcast packet on port 68, which does not make it out of the bridged Docker network unless using --net=host.
One workaround is to add a socat listener on the Docker network that forwards to the host:
and then ...
This turned out to be caused by class declarations being included inside one of the subnet declarations, when they're actually supposed to be globally defined. In turn this messed with the subnets that were defined, including the one in question.