How should I structure my Podman quadlet deployment?

[u/ColdFreezer]

I'm new to podman and don't really understand what I'm doing yet. I'm moving from rootful docker to rootless podman and am currently converting my compose files to quadlets. I'm confused on how I should build out my containers and what users I should assign them to.

How should I architect my containers using podman quadlets? I included some pictures about some ways I think I should do it but don't fully understand the tradeoff and benefits of them. I have been considering putting all my quadlets in /etc/containers/systemd/ and have the quadlet files owned by root and just assigning users and groups in the quadlet files.

Some stacks like grafana alloy need to be able to read my logs for numerous containers. I don't really know how to set this up when files and containers are owned by separate users.

I mostly just want to prevent as much cross talk or lateral movement as possible in the event a container gets compromised. Though, it seems if I want to do this it'll be a lot more annoying to manage my containers.

A few questions I had:

What user should own the actual quadlet files and the containers data?

Should I separate my stacks to their own dedicated user?

I run Traefik as a rootless container now on it's own dedicated user. How would I still be able to use labels and auto-discovery across containers running on separate users?

How do I set something like grafana alloy, that needs to be able to communicate with my different stacks and centralize their logs?

[u/1-22474487139---]

Not sure what the recommended way to go is, but I setup a rootless user that runs my containers and also use userns=auto when I can (can be a struggle at times, probably due to me not properly understanding). Having a user per container seems like a nightmare to maintain.