[sembrestels]

What type of PR is this?

Bug fix

What does this PR do? Why is it needed?

Fix two existing problems in WireGuard's container DNS and CoreDNS startup:

• Set the WireGuard service's DNS upstreams to the same Dappnode BIND defaults already published in upstream's PEERDNS. Without this setting, Docker inherits the host's resolver path, which can return incorrect negative answers. Docker's embedded resolver continues handling service aliases.
• Limit the CoreDNS port-conflict check to listening TCP/UDP sockets (netstat -lntup). The previous netstat -apn check also matched outgoing connections to destination port 53, so ordinary DNS activity could disable CoreDNS on restart even when no local DNS server was listening. Explicit USE_COREDNS=false and detection of a real listener retain their existing behavior.

Add a real-socket regression test in disposable containers and update the existing changelog.

How to test

docker build -t wireguard-dns-test .
python3 tests/test_coredns_port_detection.py --image wireguard-dns-test

The Python 3.9+ regression test uses a Node helper image (override with --helper-image). It reproduces the old false positive with a connected UDP socket, verifies that the patched image ignores it, then starts CoreDNS and verifies that a genuine listener is detected. It uses an isolated network namespace and no production VPN data.

Validation completed

• Built the AMD64 WireGuard image from this branch's unchanged Dockerfile.
• Passed the real-socket regression test against that image, including reproduction of the old false positive.
• Started a fresh server with temporary keys, wg0, and CoreDNS, without publishing host ports or mounting production data.
• Verified external DNS, local DNS, and Docker alias resolution through CoreDNS and Docker's embedded resolver; checked each default upstream separately.
• Verified that genuine nonexistent names still return NXDOMAIN.
• Restarted the fresh server's CoreDNS while an outgoing DNS socket stayed open: CoreDNS recovered, lookups passed, wg0 remained active, and the fixture's saved keys/config were unchanged.
• Passed git diff --check.

Other notes for review

This PR is based on current upstream master (3881f9f) through sembrestels/DNP_WIREGUARD. It changes DNS configuration and listener detection only; the Dockerfiles, API, runtime versions, VPN profile defaults, and saved Corefile are unchanged. The previously prepared runtime-security updates are separate work.

ARM64 and a physical VPN client have not been tested for this branch.