I use rootless docker and then also do this for my traefik container. Then, a bit of nftables config to expose to the outside world.