RaspAP running only on VLAN tagged interface

[mx5gr]

On a Raspi4 running Ubuntu 24, we have defined the following interfaces:

_network:
    version: 2
    ethernets:
      eth0:
        dhcp4: true
        optional: true
        dhcp-identifier: mac
    vlans:
      vlan60:
        id: 60
        link: eth0
        addresses: ["192.168.60.100/24"]
        routes:
         - to: default
           via: 192.168.60.1
        nameservers:
          addresses: [192.168.60.1]_

The 192.168.60.0/24 network is a tagged (PID 60) IoT network and the network that controls the Raspi is 192.168.100.0/24 (address obtained by DHCP). Both networks are available on the ethernet wire (one tagged, one not).

We want to bind RaspAP under Docker to vlan60 only, with DHCP addresses given by the main IoT router (192.168.60.1).

We tried the following to no avail:

• As we do not want the Raspi services/containers to be accessible from the IoT network, we tried to set dhcp4:false & dhcp6:false to the vlan60 interface, to no avail. It seems that the vlan interface always needs an IP address.
• We used BridgeAP mode to get addresses from the upstream DHCP server. wlan0 gets an address, no devices can connect to RaspAP.
• As network:host mode is required, we cannot run dnsmasq within the container, as we have another instance running on the main 192.168.100.0/24 interface and we cannot isolate the container attaching only to vlan50 interface.
• We tried rebuilding the image with the following iptables rules, to no avail:

_#!/bin/bash
iptables -I DOCKER-USER -i src_if -o dst_if -j ACCEPT
iptables -t nat -C POSTROUTING -o vlan50 -j MASQUERADE || iptables -t nat -A POSTROUTING -o vlan50 -j MASQUERADE
iptables -C FORWARD -i vlan50 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT || iptables -A FORWARD -i vlan50 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -C FORWARD -i wlan0 -o vlan50 -j ACCEPT || iptables -A FORWARD -i wlan0 -o vlan50 -j ACCEPT
iptables-save_

How can we run RaspAP in Docker, accessing the wired network only through the vlan60 interface (PID 60) and in BridgeAP mode?