Expose TCP port 53 to allow DNS updates under --icc=false.
Use /etc/tmpfiles.d instead of handling /var/run manually.
Workaround 1130498 - silence the noise.
The [ -w ... ] does not work on the mounted /etc/resolv.conf, just do the umount, if possible.