That seems to be the right direction. After hard coding the nameserver it works better. But: Directly after booting, the nameserver is still unreachable (failed ping) but the next ping in Uptime Kuma is fine.
I looked into service docker status. Directly after reboot, it throws several errors level=warning msg="[resolver] connect failed" error="dial udp 9.9.9.9:53: connect: network is unreachable" (only for Debian 13, not for 12). After restarting the service, they are gone. Looking into DHCP related logs, I can see that the VM gets an IP two seconds after the docker service started (one second on Debian 12), so as you said, probably a timing issue.
service docker status @ Debian 12
● docker.service - Docker Application Container Engine
Loaded: loaded (/lib/systemd/system/docker.service; enabled; preset: enabled)
Active: active (running) since Fri 2026-01-30 20:27:48 CET; 8min ago
TriggeredBy: ● docker.socket
Docs: https://docs.docker.com
Main PID: 460 (dockerd)
Tasks: 45
Memory: 155.5M
CPU: 1.478s
CGroup: /system.slice/docker.service
├─460 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
├─810 /usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 3001 -container-ip 172.17.0.2 -container-port 3001 -use-listen-fd
├─815 /usr/bin/docker-proxy -proto tcp -host-ip :: -host-port 3001 -container-ip 172.17.0.2 -container-port 3001 -use-listen-fd
├─833 /usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 3002 -container-ip 172.18.0.2 -container-port 3001 -use-listen-fd
└─839 /usr/bin/docker-proxy -proto tcp -host-ip :: -host-port 3002 -container-ip 172.18.0.2 -container-port 3001 -use-listen-fd
Jan 30 20:27:47 debian12 dockerd[460]: time="2026-01-30T20:27:47.694065941+01:00" level=info msg="Deleting nftables IPv6 rules" error="exit status 1"
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.707527531+01:00" level=info msg="sbJoin: gwep4 ''->'068aa24eaf4c', gwep6 ''->''" eid=068aa24eaf4c ep=uptime-kuma net=bridge nid=6e902107b52f
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.732300034+01:00" level=info msg="sbJoin: gwep4 ''->'5e60d2069499', gwep6 ''->''" eid=5e60d2069499 ep=uptime-kuma2 net=uptime_default nid=cf70e471f221
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.840121101+01:00" level=info msg="Loading containers: done."
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.866702427+01:00" level=info msg="Docker daemon" commit=9c62384 containerd-snapshotter=true storage-driver=overlayfs version=29.2.0
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.867366598+01:00" level=info msg="Initializing buildkit"
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.898926389+01:00" level=info msg="Completed buildkit initialization"
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.914921505+01:00" level=info msg="Daemon has completed initialization"
Jan 30 20:27:48 debian12 systemd[1]: Started docker.service - Docker Application Container Engine.
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.915320051+01:00" level=info msg="API listen on /run/docker.sock"
journalctl | grep -Ei "dhcp" @ Debian 12
Jan 30 20:27:31 debian12 dhclient[1898]: Internet Systems Consortium DHCP Client 4.4.3-P1
Jan 30 20:27:31 debian12 ifdown[1898]: Internet Systems Consortium DHCP Client 4.4.3-P1
Jan 30 20:27:31 debian12 ifdown[1898]: For info, please visit https://www.isc.org/software/dhcp/
Jan 30 20:27:31 debian12 dhclient[1898]: For info, please visit https://www.isc.org/software/dhcp/
Jan 30 20:27:31 debian12 dhclient[1898]: DHCPRELEASE of 192.168.2.122 on ens18 to 192.168.2.1 port 67
Jan 30 20:27:31 debian12 ifdown[1898]: DHCPRELEASE of 192.168.2.122 on ens18 to 192.168.2.1 port 67
Jan 30 20:27:45 debian12 audit[282]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=282 comm="apparmor_parser"
Jan 30 20:27:45 debian12 audit[282]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/NetworkManager/nm-dhcp-helper" pid=282 comm="apparmor_parser"
Jan 30 20:27:45 debian12 kernel: audit: type=1400 audit(1769801265.632:8): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=282 comm="apparmor_parser"
Jan 30 20:27:45 debian12 kernel: audit: type=1400 audit(1769801265.632:9): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/NetworkManager/nm-dhcp-helper" pid=282 comm="apparmor_parser"
Jan 30 20:27:45 debian12 dhclient[321]: Internet Systems Consortium DHCP Client 4.4.3-P1
Jan 30 20:27:45 debian12 sh[321]: Internet Systems Consortium DHCP Client 4.4.3-P1
Jan 30 20:27:45 debian12 sh[321]: For info, please visit https://www.isc.org/software/dhcp/
Jan 30 20:27:45 debian12 dhclient[321]: For info, please visit https://www.isc.org/software/dhcp/
Jan 30 20:27:46 debian12 dhclient[321]: DHCPDISCOVER on ens18 to 255.255.255.255 port 67 interval 8
Jan 30 20:27:46 debian12 sh[321]: DHCPDISCOVER on ens18 to 255.255.255.255 port 67 interval 8
Jan 30 20:27:49 debian12 dhclient[321]: DHCPOFFER of 192.168.2.122 from 192.168.2.1
Jan 30 20:27:49 debian12 sh[321]: DHCPOFFER of 192.168.2.122 from 192.168.2.1
Jan 30 20:27:49 debian12 sh[321]: DHCPREQUEST for 192.168.2.122 on ens18 to 255.255.255.255 port 67
Jan 30 20:27:49 debian12 dhclient[321]: DHCPREQUEST for 192.168.2.122 on ens18 to 255.255.255.255 port 67
Jan 30 20:27:49 debian12 dhclient[321]: DHCPACK of 192.168.2.122 from 192.168.2.1
Jan 30 20:27:49 debian12 sh[321]: DHCPACK of 192.168.2.122 from 192.168.2.1
service docker status @ Debian 12
● docker.service - Docker Application Container Engine
Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled; preset: enabled)
Active: active (running) since Fri 2026-01-30 20:27:54 CET; 9min ago
Invocation: 191de38e843c465eb969b813cb8b5a1e
TriggeredBy: ● docker.socket
Docs: https://docs.docker.com
Main PID: 666 (dockerd)
Tasks: 45
Memory: 137.4M (peak: 139.6M)
CPU: 1.381s
CGroup: /system.slice/docker.service
├─ 666 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
├─1020 /usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 3001 -container-ip 172.17.0.2 -container-port 3001 -use-listen-fd
├─1025 /usr/bin/docker-proxy -proto tcp -host-ip :: -host-port 3001 -container-ip 172.17.0.2 -container-port 3001 -use-listen-fd
├─1043 /usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 3002 -container-ip 172.18.0.2 -container-port 3001 -use-listen-fd
└─1050 /usr/bin/docker-proxy -proto tcp -host-ip :: -host-port 3002 -container-ip 172.18.0.2 -container-port 3001 -use-listen-fd
Jan 30 20:27:54 debian13 dockerd[666]: time="2026-01-30T20:27:54.528077130+01:00" level=info msg="Completed buildkit initialization"
Jan 30 20:27:54 debian13 dockerd[666]: time="2026-01-30T20:27:54.545827414+01:00" level=info msg="Daemon has completed initialization"
Jan 30 20:27:54 debian13 systemd[1]: Started docker.service - Docker Application Container Engine.
Jan 30 20:27:54 debian13 dockerd[666]: time="2026-01-30T20:27:54.546476844+01:00" level=info msg="API listen on /run/docker.sock"
Jan 30 20:27:58 debian13 dockerd[666]: time="2026-01-30T20:27:58.924185994+01:00" level=warning msg="[resolver] connect failed" error="dial udp 9.9.9.9:53: connect: network is unreachable"
Jan 30 20:27:58 debian13 dockerd[666]: time="2026-01-30T20:27:58.924379265+01:00" level=warning msg="[resolver] connect failed" error="dial udp 9.9.9.9:53: connect: network is unreachable"
Jan 30 20:27:58 debian13 dockerd[666]: time="2026-01-30T20:27:58.924524617+01:00" level=warning msg="[resolver] connect failed" error="dial udp 9.9.9.9:53: connect: network is unreachable"
Jan 30 20:27:58 debian13 dockerd[666]: time="2026-01-30T20:27:58.924611303+01:00" level=warning msg="[resolver] connect failed" error="dial udp 9.9.9.9:53: connect: network is unreachable"
Jan 30 20:27:59 debian13 dockerd[666]: time="2026-01-30T20:27:59.857217836+01:00" level=warning msg="[resolver] connect failed" error="dial udp 9.9.9.9:53: connect: network is unreachable"
Jan 30 20:27:59 debian13 dockerd[666]: time="2026-01-30T20:27:59.857612334+01:00" level=warning msg="[resolver] connect failed" error="dial udp 9.9.9.9:53: connect: network is unreachable"
journalctl | grep -Ei "dhcp" @ Debian 13
Jan 30 20:27:36 debian13 dhcpcd[1743]: sending signal ALRM to pid 616
Jan 30 20:27:36 debian13 dhcpcd[1743]: waiting for pid 616 to exit
Jan 30 20:27:36 debian13 dhcpcd[618]: received SIGALRM, releasing
Jan 30 20:27:36 debian13 dhcpcd[618]: ens18: removing interface
Jan 30 20:27:36 debian13 dhcpcd[618]: ens18: deleting address fe80::d1bb:459e:50fb:61e3
Jan 30 20:27:36 debian13 dhcpcd[618]: ens18: releasing lease of 192.168.2.120
Jan 30 20:27:36 debian13 dhcpcd[618]: ens18: deleting route to 192.168.2.0/24
Jan 30 20:27:36 debian13 dhcpcd[618]: ens18: deleting default route via 192.168.2.1
Jan 30 20:27:51 debian13 ifup[598]: dhcpcd-10.1.0 starting
Jan 30 20:27:51 debian13 dhcpcd[598]: dhcpcd-10.1.0 starting
Jan 30 20:27:51 debian13 dhcpcd[611]: DUID 00:01:00:01:31:0d:34:ae:bc:24:11:51:2e:82
Jan 30 20:27:51 debian13 dhcpcd[611]: ens18: waiting for carrier
Jan 30 20:27:51 debian13 dhcpcd[611]: ens18: carrier acquired
Jan 30 20:27:51 debian13 dhcpcd[611]: ens18: IAID 11:51:2e:82
Jan 30 20:27:51 debian13 dhcpcd[611]: ens18: adding address fe80::d1bb:459e:50fb:61e3
Jan 30 20:27:53 debian13 ifup[611]: ens18: soliciting a DHCP lease
Jan 30 20:27:53 debian13 dhcpcd[611]: ens18: soliciting a DHCP lease
Jan 30 20:27:53 debian13 dhcpcd[611]: ens18: soliciting an IPv6 router
Jan 30 20:27:56 debian13 dhcpcd[611]: ens18: offered 192.168.2.120 from 192.168.2.1
Jan 30 20:27:56 debian13 dhcpcd[611]: ens18: probing address 192.168.2.120/24
Jan 30 20:28:02 debian13 dhcpcd[611]: ens18: leased 192.168.2.120 for 43200 seconds
Jan 30 20:28:02 debian13 dhcpcd[611]: ens18: adding route to 192.168.2.0/24
Jan 30 20:28:02 debian13 dhcpcd[611]: ens18: adding default route via 192.168.2.1
Jan 30 20:28:05 debian13 dhcpcd[611]: ens18: no IPv6 Routers available
Debian 12 also seems to deal differently with resolv.conf. Both VMs don’t get the nameserver via DHCP anymore, but on Debian 12 the old nameserver is still remembered. Here are the resolv.conf without hard coded nameserver:
resolv.conf @ Debian 12
domain lan
search lan
nameserver 9.9.9.9
resolv.conf @ Debian 13
# Generated by dhcpcd from ens18.dhcp
nameserver 9.9.9.9
domain lan
# /etc/resolv.conf.tail can replace this line