Are you using one (system) user per quadlet? (Why?) Each of my quadlets is owned by the same (non-root) user and the containers are rootless. In that case, podman deals with (sub)id-allocation. selinux-labels take care of volume scopes and podman networks are as isolated as possible. Seems enough for me; never even considered using different users in that case.

Thanks for the analysis; I had also seen the API keys, but I didn’t check the deployments.

I guess this answers my question then: No one is using it because not even the dev gets it deployed – highly “avaliable” 🤣

To be fair, the proxy engine is supposedly written in go, not in nodejs, but yeah, the ddos defense most likely is wishful thinking…