The best way is to disable password login and use SSH keys only. Any further steps are not required, but you may additionally install fail2ban or sshguard.

It asks for a path to a root directory of a bootstraped container. You can create it with debootstrap, rinse, pacstrap, alpine-chroot-install, virt-bootstrap etc.

virt-manager is able to work wit lxc. Add a new connection of type Libvirt-LXC.

Yes, you can.

Nope. Free beer ≠ free speech.

That was many years ago, so I don’t remember all of them. E.g. Chromium was unable to display pages (was it installed from testing? or it was from stable but some of its dependencies from testing? I forgot).

Yes, this is possible if you configure preferences (see man apt_preferences). However if you install numerous packages from testing, this can lead to various bugs. I used to do such installation and concluded that it is better to avoid this.

Do you really need OPNsense? Buying a OpenWrt capable router would save your money, place and silence.

Well, I don’t use proxmox, however docker coexists with libvirt and other virtualization systems. If there are overlapping networks that docker ant proxmox attempt to manage, they are configurable.

Snapshotting in docker is as easy as docker commit. After that you can back it up with docker save. Then move to another host, but not without downtime.

However normally you need to backup/move only volumes attached to containers. If that’s not the way how you like to organize your services, you likely don’t need docker.

What’s the purpose of running container in a container? Why not install docker on your host machine?

I meant software RAID of course. Hardware RAIDs just cause headacehes, but fake RAIDs that are built into motherboards are a real nightmare.

Building RAID on top of SSDs is an answer.

With fail2ban single bot behind a NAT can make the site unaccessible for all users behind that NAT.

Isn’t Quake already open source?

Disable systemd-resolved.service? Uninstall systemd-resolved?

No, it is impossible to solve this on filesystem level. In theory, it would be possible to adopt some video codec for compression of such photo series, but it would be a lot of work to integrate it into immich.

Bank clients. Taxi aggregator clients.

What error you get exactly?

It is easy to get hacked if you make stupid mistakes. Just don’t make them.