Hexarei

There's always the fork network graph, but it's not exactly easy to spot which forks are good, just the ones with the most recent commits

Well they are both interoperable

Certbot also does DNS challenge, fwiw

DNS challenge makes it even easier, since you don't have to go through the process of transferring it yourself

I lent my 8yo my old phone, heavily restricted and with Family Link installed; She's only allowed 2 hours a day and isn't allowed on stuff like YouTube. There are ways to do it responsibly.

Worth mentioning: Anyone using TachiyomiJ2K (I use it for Surface Duo dual-screen support) or another fork with support who has some self-hosting prowess, there's always Suwayomi - It will let you "migrate" to a third-party sources repo even if your app doesn't support it, since it becomes your device's only local extension.

Others have addressed the root and trust questions, so I thought I'd mention the "mess" question:

Even the messiest bowl of ravioli is easier to untangle than a bowl of spaghetti.

The mounts/networks/rules and such aren't "mess", they are isolation. They're commoditization. They're abstraction - Ways to tell whatever is running in the container what it wants to hear, so that you can treat the container as a "black box" that solves the problem you want solved.

Think of Docker containers less like pets and more like cattle, and it very quickly justifies a lot of that stuff because it makes the container disposable, even if the data it's handling isn't.

Ah, neat! I just looked it up and it does look useful.

I've never really had any trouble with dark reader speed-wise - though it gives one major bonus that no other extension has so far: Attempting to match the appearance of darkened websites to my system theme (Catppuccin)

I can't tell if you're agreeing with me, disagreeing with me, or suggesting some alternative

Their recognition doesn't change the fact that it's in the public domain

I highly recommend the Dark Reader extension for your browser

The solution for me is that I run Nextcloud on a Kubernetes cluster and pin a container version. Then every few months I update that version in my deployment yaml to the latest one I want to run, and run kubectl apply -f nextcloud.yml and it just does its thing. Never given me any real trouble.