They could probably give them a jelly of the month club subscription that should keep them happy

Oh didn’t realize this was only in lineageos and not yet in Android proper works pretty well.

It’s like Google saw it coming when they made alphabet

Chipotle raspberry sauce. I’m not sure on that one

I would reconsider docker because if a specific application leaks some sort of shell access or system file access you’ll be protected out side of container host escalation.

Unrelated to security, I prefer docker because it leaves the server very clean if you remove different apps. Can also save time configuring more complex applications or applications that conflict with system libraries.

Add fail2ban on your list of applications it watches logs for invalid logins and puts them on firewall block rules after so many failed attempts.