@icedquinn @captainepoch cross-signing this one. you can do all the "rootless" things, but if your threat model is "1% chance of nsa getting into your systems, otherwise the cat may knockover the server" go with the path of least resistance.
if docker works, great use it. i wouldn't bother with the rootless container setup as it's more bullshit than it needs to be.