diff --git a/meta-edgeos/recipes-core/systemd/systemd_%.bbappend b/meta-edgeos/recipes-core/systemd/systemd_%.bbappend
index 9f843ec..7e422d2 100644
--- a/meta-edgeos/recipes-core/systemd/systemd_%.bbappend
+++ b/meta-edgeos/recipes-core/systemd/systemd_%.bbappend
@@ -1,8 +1,30 @@
 
 inherit journal-persist
 
-# make sure the systemd recipe builds the networkd subpackage
-PACKAGECONFIG:append = " networkd"
+# make sure the systemd recipe builds the networkd and resolved subpackages
+# resolved is needed for proper DNS resolution in containers
+PACKAGECONFIG:append = " networkd resolved"
+
+# Configure systemd-resolved for proper DNS in containers
+do_install:append() {
+    # Enable systemd-resolved service
+    install -d ${D}${sysconfdir}/systemd/system/multi-user.target.wants
+    ln -sf ${systemd_system_unitdir}/systemd-resolved.service \
+        ${D}${sysconfdir}/systemd/system/multi-user.target.wants/systemd-resolved.service
+
+    # Configure resolved to create /run/systemd/resolve/resolv.conf
+    # This file contains actual DNS servers (not the 127.0.0.53 stub)
+    install -d ${D}${sysconfdir}/systemd/resolved.conf.d
+    cat > ${D}${sysconfdir}/systemd/resolved.conf.d/10-edgeos.conf << 'EOF'
+[Resolve]
+# Use this for fallback DNS if no other DNS is available
+FallbackDNS=8.8.8.8 1.1.1.1
+# Don't use LLMNR (Link-Local Multicast Name Resolution)
+LLMNR=no
+# Use mDNS for .local domains (Avahi compatibility)
+MulticastDNS=yes
+EOF
+}
 
 # systemd persistent log
 # Install the drop-in and tmpfiles rule ONLY when this feature is enabled.
@@ -23,6 +45,12 @@ d     /var/log/journal      2755  root systemd-journal   -   -
 EOF
 }
 
+# Ship systemd-resolved configuration
+FILES:${PN}:append = " \
+    ${sysconfdir}/systemd/system/multi-user.target.wants/systemd-resolved.service \
+    ${sysconfdir}/systemd/resolved.conf.d/10-edgeos.conf \
+    "
+
 # systemd persistent log
 # Only ship these files when the feature is enabled.
 FILES:${PN}:append:journal_persist-on = " \
diff --git a/meta-edgeos/recipes-core/usb-gadget/files/10-usb0.network b/meta-edgeos/recipes-core/usb-gadget/files/10-usb0.network
index 8bf3357..1b64786 100644
--- a/meta-edgeos/recipes-core/usb-gadget/files/10-usb0.network
+++ b/meta-edgeos/recipes-core/usb-gadget/files/10-usb0.network
@@ -1,33 +1,24 @@
 #/etc/systemd/network/10-usb0.network
+# USB gadget network configuration
+#
+# Strategy: DHCP client with link-local fallback
+# - If host runs DHCP server (e.g., macOS ICS): get IP via DHCP
+# - If no DHCP server: auto-configure link-local (169.254.x.x)
+# - Always available via IPv6 link-local (fe80::...)
+#
+# This avoids DHCP server conflicts with macOS Internet Connection Sharing
+# while maintaining connectivity in all scenarios.
 
 [Match]
 Name=usb0
 
 [Network]
-Address=192.168.7.1/24
-DHCPServer=yes
-ConfigureWithoutCarrier=yes
-# Enable IPv6 link-local addressing
+# Request DHCP address from host
+DHCP=yes
+# Fallback to link-local if no DHCP server responds
 LinkLocalAddressing=yes
+ConfigureWithoutCarrier=yes
+
+# IPv6 link-local configuration
 IPv6LinkLocalAddressGenerationMode=eui64
-IPv6DuplicateAddressDetection=both
 IPv6AcceptRA=yes
-IPv6SendRA=yes
-
-[DHCPServer]
-PoolOffset=2
-PoolSize=1
-# Optional extras:
-# EmitRouter=yes
-# DNS=192.168.7.1
-# EmitDNS=yes
-
-[IPv6SendRA]
-# Low priority to allow macOS ICS to take precedence
-RouterPreference=low
-# Short lifetime for quick adaptation to network changes
-RouterLifetimeSec=30
-# Don't advertise as gateway or DNS
-EmitDNS=no
-Managed=no
-OtherInformation=no