You need the G account to be able to install apps from Play Store, I don't believe the private space itself requires it.

Not sure if there's some Play "integrity check" on stock ROMs, but on GOS I was able to create the private space and download&install F-droid or other APKs just fine, without a Google account.

The official app doesn't need to be running constantly. It only needs to connect to Meta's servers once every 14 days.

The Mautrix-Whatsapp bridge will send a notification couple of days in advance to warn you if the main device hasn't been active.

It might work, I haven't tried. But I think that's also quite complicated for most people.

I've also heard quite a few people getting their number banned by only running in an emulator. If it's an older WA account, it's probably safe, but I wouldn't do it on a fresh number.

This is true.

I use WA via the Matrix bridge. WA requires the official mobile app (not web) to connect every 14 days, so you need to have it on a separate profile, a spare phone or do a complicated Android emulator setup... To be usable you need to allow the WA app access to your contacts, which results in Meta getting just about the same metadata from you it would via using the official app.

If I wasn't using Matrix for other things like notifications from servers, I wouldn't bother with this. The only upside is having only one app for messaging. The bridge system itself works really well, nothing bad to say there.

I've never used Portainer, but does it have an option to only notify of available updates?

For things that I don't mind breaking, I use latest. For the services that matter, use a specific version. Take Immich for example, in the 2-3 months I've kept it running, there's been 3 breaking changes that would prevent startup after update without manual intervention. Immich is an extreme though, some other projects have been working fine with latest without touching them for years.

I follow the important projects' releases (subacribe if possible), and update manually when they publish an image with a new version. I'd see it as either updating manually and being OK about possibly being a version behind every now and then, or using latest+auto updates and being OK with waking up to broken services every now and then. Which might never happen.

If I had money laying around, this would make a compelling home server. With a minimal GPU, or without one, if possible.

Maybe you get the possibility of routing all traffic from a container (or all the containers in that namespace/network) over the tailnet this way? With the host method, you'd need the host to use the exit node too.

Have you considered lowering the unprivileged port limit instead?

sudo sysctl -w net.ipv4.ip_unprivileged_port_start=53 | sudo tee -a /etc/sysctl.conf  

Then remove the firewall rule and bind to port 53.

Edit: typo