networkmanager likes to do dumb things with container networking, its probably that