Hey, thanks for the answer! Late reply I know. I’m running all the containers separately right now and just gave up with the pods. I thought about separate pods briefly, but didn’t do it, because I don’t understands pod networking properly and read some conflicting info. Would you separate gluetun and qbittorrent on different pods? From what I remember I couldn’t get gluetun to properly take over the pod’s networking and didn’t want to risk any leaks despite binding qbittorrent.

Ty for the detailed reply. I know late answer, but after some reading it seems like pods can’t do what I had in mind. So I just spun my containers up “normally” without pods.

Used Pixels are often pretty misused and refurbished ones cost the same or even more than a new Pixel in my country… which is actually insane. Hopefully the new Graphene collab phone will be good.

I’ve been running Docker for various things on Windows before and I’m not a stranger to computers and tech in general, so that’s why I went this deep from the get go. The whole stack works and I’m like 90% sure that it works the way I want it to work, I just want to make it better (and “bullet proof”). I don’t have much experience with networking or Linux, though, so yeah, this was quite the challenge haha. Thanks again for the help, I’ll have a look at your quadlets.

I see, that makes sense. Thank you.

Yes, rootless podman.

Just to see if I understood correctly: So your container is running as 999, and UserNS=keep-id:uid=999,gid=999 maps 999 (the user used inside the container) to the host (in my case 1000). So any files the container creates have their permission set to 1000 and can be read/modified by both the host user (1000) and the container. UserNS=keep-id:uid=999,gid=999 ONLY maps the UIDs and does not set the UID of the container.

I think I understand now, thanks for the example, that helped.

Thanks for the answer.

To

1. Maybe I worded that poorly, I do understand that I can’t take out the engine haha (good analogy). I thought gluetun was supposed to set the default route (but it seems it either doesn’t or can’t), I’ll dig deeper into manually setting a default route for containers. My goal was to only have gluetun see my computer’s network and have the containers only see local network and gluetun’s tun0 network (with default routing through tun0). AFAIK pods share network namespaces, though, so that might not be possible? (even without pods?)

2. The quadlets are in the spoiler at the bottom of the post. I’ll move the spoiler up a bit

3. So they would be rootless containers, but have root access as 0:0, if I understand that correctly? linuxserver images require 0:0 or they won’t start, do you happen to know a workaround?