I checked the firewall. Just today I did some container tech / firewall exploration at work so I was already a little bit warmed up. I immediately saw that my container network's subnet was missing from the nft set masq_saddr! Yeah, of course, I rebooted the server, and IIRC I added it manually so many, many months ago. 🤦

I added it manually because I wanted to determine the network myself and not rely on some randomly chosen subnet. For this, I added the address in a systemd.network drop-in file. That worked great but I didn't know how to get rid of the randomly chosen address. This address was still in the masq_saddr set 😀.

Meanwhile I learned that many options that can be used multiple times can be cleared by setting them to an empty value before setting the wanted value. I did this and got rid of the pre-selected address!