Dnsmasq needs an upstream server to resolve the DNS queries. That upstream server can be anything, Google, Cloudflate, Quad9, or, a local Unbound instance.

You run an unbound server with a static IP, and point dnsmasq to said static IP.

OPs setup has this configured through Pi-hole. Look at the docker-compose file.

Edit: I just remembered Pi-hole has an official guide for this: https://docs.pi-hole.net/guides/dns/unbound/