My experience with ente was that it is horribly slow. It also lacks any feature to upload a large number of photos at once. I just never bothered uploading my 10k pictures I have taken over the last 15 years because it would have had to transfer them to a phone and then have the app open for a few weeks. No rclone or any other reasonable way to upload from a computer other than browser (which just doesn’t work for more than a few images)

Podman is pretty mutch a drop in replacement for docker but it runs in user context instead if root.

All docker commands work with podman by just replacing the name including podman compose.

(You do have to specify docker.io as a repository if you want to pull images from docker hub but that is literally the only difference In usage I ever noticed)

1. is there a reason you don’t use podman instead of rootless docker?
2. can you run patchmon inside of docker and mount the socket to the original path inside of the container?
3. the symlink has the file permissions of the file it points to. If the socket is owned by a user, so will the symlink, even if you used root/sudo to create the link. (technically the symlink will be owned by root, but the permissions on a symlink are ignored and the permission of the target are used)
4. as long as you don’t change any permissions on /var/run or on the docker.sock to be more permissive than they are now, there is functionally no difference in security
5. If you or someone else on the system tries to run docker with a different user/root, the symlink will likely cause issues

Yeah precice phrasing ia hard sometime. I was refering to delete/modify of files as “changes to the fs”. Not sure how changing the actuall fs would be relevant to the backup question.

OP needs a restricted shell that can take backup data and write it to disk but not be able to modify anything that is already there. Nano and rsync can both do that.

Nano and rsync are 100% designed to modify the filesystem. But yes the idea is correct.

Same with got over ssh, you restrict the connection to the got shell that can only do the things you want.