Discussion
Yet another reason to _always_ isolate your containers in VMs on a locked down bridge. Side-by-siding containers directly on the host with 'rootless' is not true isolation. Docker networks can also be a hot mess, and the given project's own firewalling can scribble/overstep that of host firewall.
If lacking the knowledge to isolate properly, just stick with one Docker project per VPS.
Thanks @themadhatter for the heads-up on this one. Woke up to it.
@mez For smaller VM pools I tend to use native Qemu/KVM, host passthrough mode, each guest on a local bridge network, reached over SSH with host-local pubkey auth, shell scripts for management. Locked down Debian GNU/Linux host. FreeBSD with bhyve is really nice too.
@mez When handing a VM to an org to manage themselves, I put it on the VPN, hand out the conf, and they tunnel right in without touching the host (not a fan of multi-user systems).
@JulianOliver What's your preferred VM setup for this?