curl bash is not as bad as people think. Nobody downloads and reverse engineers binary packages off of these websites before running them with the same permissions.

This is great for the shareholders.

If you’re running insecure services, you can restrict them to be accessible by vpn. I have a mix of internet accessible and vpn accessible services using the tailscale nginx plugin.

If you want to send all your traffic over a vpn, you will either need to route all your traffic through your own vpn or use some sort of multiplexed vpn. tailscale can do this with mullvad, but it’s not yet possible with headscale.

That’s 182.5k a year. They’d need to be making several times the average US lawyer salary to shrug that off. Most lawyers don’t make that much money post taxes.

Helm is what is used for real world software deployments. It has its problems but it’s better than Docker Compose.