'workarounds' to get systemd-networkd to work in bullseye

What is the bare minimum of workarounds https://github.com/lxc/distrobuilder/blob/master/distrobuilder/main.go#L537 to get systemd-networkd to work in a (unprivileged) bootstrapped bullseye container?

I get an IP address via systemd-networkd dhcp with the following config:

$ cat /etc/systemd/system/service.d/lxc.conf
[Service]
ProtectProc=default
ProtectControlGroups=no
ProtectKernelTunables=no
NoNewPrivileges=no
BindReadOnlyPaths=/sys /proc