This sounds great - and I wish UNIX namespaces were adopted more widespread for things like "local configurtion web UI". As a workaround, (I believe, though on

This sounds great - and I wish UNIX namespaces were adopted more widespread for things like "local configurtion web UI". As a workaround, (I believe, though only through a cursory web search and haven't tested) you can use network namespaces and socat to proxy traffic from Unix sockets to a private IP:port range only visible to your user - taking that part of containerization without necessarily having to execute things inside containers.