Totally agree. I think you’ve picked up on an attitude problem I need to fix, as that is keeping me from embracing a really useful technology. You caught me admitting to a bias that I know isn’t always true.

I’m a bad one to get how-to advice from if you’re starting out. Not a fan of docker and I don’t know what watchtower is. I’m one of those electricity-wasting home labbers who loves ESXi, vlans, and /30 nets for each individual VM.

I’m also one of those who takes months to accomplish what someone competent can do in days. It’s taking me forever to get openldap, postfix, dovecot, and roundcube to all play nice. (Because I’m trying to “be like daddy” and mimic the security I see at work, I can’t follow normal walkthroughs, or just install an off the shelf container and make it someone else’s problem. But this way makes me read manuals and gain a deep, durable understanding of the technology. And it takes forever.)

Some browsers have an option for DNS over https, and might be skipping your system DNS settings. Other advice is right too: run this locally and don’t expose it to public internet queries.

Security is a tough thing to give advice about. Different people have different levels of risk tolerance. It’s embarrassing to give advice about one’s personal views - tedious to write - and then get replies about how that’s too much security, too little security, etc.

Attackers can use tricks to enumerate dns subdomains. They can compromise one container and pivot to the container host.

You can frustrate automated compromises by putting up roadblocks or speed bumps they have to get through before seeing the stock landing or login pages for well known apps. That can buy you a little time if a serious exploit is discovered and you know you won’t be on top of container updates. But stay on your container updates.

I agree with nearly everything I’m seeing. Maybe to summarize:

Laser of any kind is shelf stable. Liquid ink dries out and different printers compensate for this in different ways. Even dumb ink tank printers - where you add liquid and there’s no chip to be read anywhere - can have internal ink sponges that fill up and cause failures. Just a different kind of chipped consumable.

Color laser means four smaller cartridges and an extra wear part to replace after a few years: ITB or intermediate transfer belt. Instead of going from toner drum to paper, toner goes onto this belt first and then to the paper.

Different printer manufacturers have different behaviors to lock you into only buying their consumables. HP tends to be the worst offender, but it varies.

I got lucky, bought a used HP Color Laserjet Pro MFP M477fdw. Basically two generations old, and the top of their desktop / tabletop printer line without being tabloid / large-format or being a huge copy machine / document station.

Toner chip validation is an option you can turn off. For now. But individual components have firmware versions and can be incompatible with each other, so I’m fully confident I’m one part replacement away from needing to update firmware on everything else and losing this tolerant behavior. A full refill of all four cartridges (5000 pages) totals like $65 right now, so that will suck.