Running a local DNS service on modern Linux can clash with systemd-resolved, which often binds to port 53. Starting dnsmasq directly on the host leads to port collisions and resolver interference. This setup uses a separate network namespace and macvlan interface to isolate dnsmasq, giving it its own IP address and network stack.

The architecture creates a dedicated namespace (e.g., `dnsmasq`) with a macvlan interface attached to a parent like `eth0`. This provides a unique MAC address, IP, and routing. By binding dnsmasq to this isolated IP, it avoids competing with the host's resolver, allowing both services to coexist without disabling or reconfiguring systemd-resolved.

A minimal `dnsmasq.conf` uses `bind-interfaces` and skips host resolver inputs with `no-resolv` and `no-hosts`. The deployment uses a templated systemd unit and helper scripts for setup, run, and cleanup. The runtime script uses `nsenter` and `setpriv` for least-privilege execution, retaining only `net_bind_service` to bind port 53, making the service manageable and secure.