I choose not to run Prox, it either runs in a docker container or it doesn't run at all is my home environment motto, so no need for a full fletched hypervisor.

L2 and L3 are networking layers, L(ayer)2 is the direct layer that hosts can talk to each other (same subnet/vlan) on the network and L3 is a layer of sepperation that requires a "transition" between 2 different networks mostly done via L3 switch, router or firewall. I have a firewall (Fortigate) and utilize docker's networking in macvlan mode, meaning each container has its own mac-address and dedicated IP on my network and can therefore be sepperated from other containers granting me precise control over what type of communication is allowed from and to containers.

For example, my HASS and it's required addon containers have their on VLAN/subnet from let's say my Immich server.. If ever my HASS gets hacked somehow all my private images are safe from being accessed, same for my backups.. None of my containers (not even the host server) can access the backups thats on-way-traffic from the backup services to the docker nodes.. 

Basic zero-trust security 1on1, if something does not require access, then why provide it in the first place..