WIP: Split portals into host and container

After this DNS is resolvable from the host.  This is quite horrible.  An
alternative could be to run a pod on each node with host port 53/udp and make
it be a node-local cluster DNS proxy.  It's a bit simpler for overall config
too - just put localhost in resolv.conf.

But this also works.  We still need to plumb the cluster DNS server IP to
each node's resolv.conf

Needs testing and a couple of error-handling bits, hence WIP.