I’ll go against the grain on this one, I actually think something akin to this is the right approach.

“Protect the children” will have to go somewhere, it’s not going to just die. Getting kids devices, with locked down access is better than the ridiculous changes to the internet that are being planned.

This might not be the right implementation, but I think the idea is along the right lines… or at least, the least worst option.

I don’t know how much hackery and fuckery there is with docker specifically. The majority of what docker does was already present in the Linux kernel namespaces, cgroups etc. Docker just made it easier to build and ship the isolated environments between systems.

I assume portainer communicates via the docker socket? If so, couldn’t you just point portainer to the podman socket?

Meh, it’s just software