containers reach network-online only with a dhcp lease, and bao users wait for it

nix/container-modules/swarm-container.nix

@@ -45,6 +45,13 @@ in
     (lib.mkIf (!cfg.privateNetwork) {
       networking.firewall.enable = false;
     })
+    # A private-netns container with an interface takes its address from the
+    # hive's DHCP. dhcpcd counts an IPv4LL address as an address, so without
+    # these `network-online.target` is reached on 169.254.x before the lease.
+    (lib.mkIf cfg.privateNetwork {
+      networking.dhcpcd.extraConfig = "noipv4ll";
+      networking.dhcpcd.wait = "ipv4";
+    })
     (lib.mkIf cfg.writesOwnResolvConf {
       networking.resolvconf.enable = lib.mkForce false;
     })