The resolver is in your country too

Data residency covers the disk. Then someone asks about DNS. Every hostname a container resolves is a query that leaves the building, and a public resolver in another jurisdiction sees all of them.

On Hoody the exit path is host configuration. PATCH the container's network with a SOCKS5 exit your company runs in Zurich and dns_servers pointing at your own resolvers, up to four of them. The route is enforced on the host, outside the container: once an exit is set, direct egress is removed, and a process inside can't add its own route or fall back to a direct connection.

The whole outbound surface of the container, the connections and the lookups that precede them, exits through infrastructure you own, in a jurisdiction you chose, and the container has no vote.