Assuming this is all true, sure its not great but how much does it matter?
Most have jellyfin in a docker. My jellyfin can’t only has read only accses to the media folder. Only the config folder has write access. Assuming the worst case scenario here, how much damage can than do?
I’ve been using jelly since just after the emby fork and never had an update issue on docker. Automatic snapshots every 5 mins (amoung other backup tools). means I don’t need to worry much if it does.
Owncloud infinite scale seems, well, much more scalable
The thing I like most about linkwarden is that it integrates with my existing single sign on (authentik). After you get to a certain number of apps, it becomes extremely annoying to not have this so I now look for SSO as a major factor when deciding what app to use.
The small android app that allows android share button to send links to the app and full archive options also make it fantastic
The best and most versatile system is having domains and a reverse proxy that has internal and external domains. Ie jelly.example.com and Vaultwarden.internal.example.com
Then you add authentik which does SSO for many app like nextcloud, immich, linkwarden etc. For apps that don’t integrate, you can still use his with reverse proxy authentication (sonarr).
Naturally this is more complex to setup but nothing beats the versatility.
I can choose extra protection for things like vaultwarden (need to connect via wiregaurd). Make things external for other users to access easily (immich, jellyfin, etc). Everything is based on users that are made in authenticatik and they all have the same password with single sign on.
You would approach this is pieces. get the domain and reverse proxy working first. Then authentik. this is only realistic with docker compose.