or better (because there's no nasty reachability from browsers or the net) just use an unix-domain-socket and bind mount that and the secret cookie to the conta

or better (because there's no nasty reachability from browsers or the net) just use an unix-domain-socket and bind mount that and the secret cookie to the container (I use that with bubblewrap for appimages)