Worked like a charm. Remember to take backups beforehand in any case!

Check out the krun runtime for podman, if you want stronger container isolation from the host. It creates a small VM for each container. Gpu passthrough on linux is limited though.

Sorry for not answering directly to your question, but why not just use subuids for separation instead?

podman run -d --restart unless-stopped \
  --uidmap "+0:@100001:1" \
  --name nginx-1 \
  --port 8081:80 \
  docker.io/library/nginx

podman run -d --restart unless-stopped \
  --uidmap "+0:@100002:1" \
  --name nginx-2 \
  --port 8082:80 \
  docker.io/library/nginx

From their site:

Taler does not introduce a new currency. Taler uses a digital wallet storing coins and payment service providers with settlement accounts in existing currencies. Thus, Taler’s cryptographic coins correspond to existing currencies, such as US Dollars, Euros or even Bitcoins.

deleted by creator

Are you running rootless or rootfull containers?

At least with rootless containers (I have not used roortfull) I think its quite pointless to create separate users for the services, as you could use just the subuids (and/or SELinux) to get container separation, as you already seem to do .

I run my quadlets with uidmap and gidmaps, so I get explicit control of the mappings. It can be a tad tedious at times but I think it’s worth the hassle.

Yes, between major releases there can be breaking changes. But within there wont be, which is what I was referring to. In “V1” we didn’t have such a guarantee.

V3 is stable. It is the new version after V2. V1 was where the majoriry of the breaking changes happened.

Using cloudflare tunnels means that the TLS is terminated at cloudflare. This means that cloudflare has the capability to snoop on your traffic, so you have trust cloudflare not to do that, especially if your traffic contains sensitive information.

Also, the ‘no media in free tunnels’ is outdated information as far as I know, so be sure to check up to date information on that.