this is incredible thank you very much, I will read through this once I have more energy lmao, this looks like okay dense content, very interesting

So far I’ve circumvented networking with different users by mapping everything through localhost, without stuff going outside the network, how would you connect say; a service running on user A, on network A, to a service running on user B, on network B?

So far I can’t imagine how to connect both, unless im doing some disgusting nftables hackery, which is an option I COULD take, just one I dont want to take.

Had no idea either of these existed, I usually let myself go at the applications themselves searching for a way to setup a minimal environment, so I often miss these kind of convenience tools, either cuz I dont look for them, or cuz im a stubborn bitch lol, will check these out, so thanks for ur input :)

Never delved into SELinux, honestly afraid (lazy) of navigating getting into yet another rabbit hole, but from the rest of the answers here, letting podman deal with isolation sounds like a better solution. tysm for ur input :)

its my larp an I get to decide how hellish I want my server to be!!! 😡

excellent solution, just have root container to --user and use the auto userns, had no idea about that, sounds super convenient. Much more self contained, just let the program do its thing, I had no idea about userns=auto with root, tysm for ur input!! :)

I think having a clear understanding of what is and isnt allowed is a good thing in any scenario. I dont think making everyone afraid to post is a good solution to trolls pushing the boundaries (that they would be pushing anyways). And in any case, the mods have a final say in such matters, thats why they are there, hopefully it doesnt come to that tho.