Hardcoded resolver 127.0.0.11 only exists on user-defined networks, so a plain docker run on the default bridge 502'd (DNS connection refused). Render the resolver from /etc/resolv.conf at start so per-request proxy_pass resolves on both the default bridge (host DNS) and compose networks (embedded DNS).