Also, an interesting thing is using systemd-resolved for DNS-over-TLS or hosts blocking.

I configure it to my nextdns account and podman uses it for all requests, so I can block dns records from anywhere and use some tracking, mining, NSA, minimum domain age, etc, blocklists.