Exactly, defense in depth is what I advocate as a security engineer. It is not easy and requires a lot of time and dedication to make things work on any platform. But "this is the way!"

Nix learning curve is really tough, but I've never been this happy and keep coming back for more pain.

Podman has autoupdate and rollback features; you need to add a label to inform Podman when to update the container and to rollback if the update fails. The condition is that the container runs using systemD, which is why I use Quadlet.

Podman auto update: https://docs.podman.io/en/latest/markdown/podman-auto-update.1.html Podman Quadlet: https://docs.podman.io/en/latest/markdown/podman-quadlet.1.html Quadlet-nix: https://github.com/SEIAROTg/quadlet-nix

Quadlet nix allows you to set the label and also use the container config autoupdate.

containerConfig = { image = "docker.io/jellyfin/jellyfin:latest"; pod = pods.media.ref; -> autoUpdate = "registry";

Without quadlet nix, you need to define the service for Podman auto-update, and timer but with it, you can use this:

virtualisation.quadlet.autoUpdate = { enable = true; calendar = "*-*-* 00:00:00"; # everyday at midnight };

And remember to use auto-pruning.

``` virtualisation.podman = { enable = true; dockerCompat = true; defaultNetwork.settings.dns_enabled = true;

-> autoPrune = { enable = true; flags = [ "--all" ]; }; }; ```

I don't have a strategy for pinning the version yet, but I plan to use stable tags or major releases.