Aedifico on Nostr: Cool, I am checking it. I am also using rootless docker for isolation + caddy sidecar ...

Cool, I am checking it. I am also using rootless docker for isolation + caddy sidecar to hide the credentials. But docker is vulnerable to kernel issues, and smarter agents could break out easily. App containers are not really for secure isolation. What are your thoughts and mitigations for these?