This is necessary for clusters that run an arp lockdown on boss.  This
eluded me for a long time.  None of the documented ways to set the mac
address of an endpoint on container create work (they only work on
post-create network attach).  You have to use some special, weird,
undocumented magic.