This is on my todo list. I use Docker-compose for it’s simplicity, but Docker is a security nightmare. If you are not careful, it would expose your Nextcloud instance to the whole world. Podman integrates nicely with firewalld which gives me zone based rules. Can’t wait to do this. But I will give sometime to let Quadlet get stabilized and popular.

This is why I like GrapheneOS on phone. It is hardened and secure, but never gets in the way of your work. Everything works as it should. Kicksecure is the closest on the desktop space, though Fedora is also reasonably secure.

I think it depends on maintainer of the device. For me personally, LineageOS has broken a basic workflow like having Signal voice/video call. None of the IM apps are able to pick audio from microphone on my device (and various other models as well) due to a bug in LineageOS for almost 6 months. I regret installing it.

FSF does not get in the way of security. FSF believes source code should be publicly available in order to even assume the software is secure or private. In a perfect world that would be nice. But in the real world, proprietary blobs are required to make the hardware functional. As long as OEMs are removed about open sourcing the firmwares, both GrapheneOS and GNU are right in their own way.

Yep. It was developed to improve parallelization and security of Firefox. Many core parts of Firefox have been replaced with Rust implementations.