Containers that require custom DNS queries about incoming connections from a non-HTTP service (we're using the NLB for this), using a caching DNS server that isn't publicly accessible.