seems like a fire hazard no?

It all just depends on how much you trust the app, and how you’ve set up things when it does go wrong. Not every container needs to be able to access other containers on the system, lan, have access to whatever folder, read/write permissions, etc

A good practice for things like vaultwarden would be to only whitelist the country/state you’re in to minimize your attack profile

fail2ban or crowdsec can also help with all the rats sniffing around

alternative (superior) open source extension: https://github.com/cavi-au/Consent-O-Matic

encrypted Rsync to a free Backblaze account. be sure to test your backups tho

how are you doing your backups now? are you using the 3-2-1 backup strategy?