This is on my todo list. I use Docker-compose for it’s simplicity, but Docker is a security nightmare. If you are not careful, it would expose your Nextcloud instance to the whole world. Podman integrates nicely with firewalld which gives me zone based rules. Can’t wait to do this. But I will give sometime to let Quadlet get stabilized and popular.

This is why I like GrapheneOS on phone. It is hardened and secure, but never gets in the way of your work. Everything works as it should. Kicksecure is the closest on the desktop space, though Fedora is also reasonably secure.