Podman is better, but believe my words, try nixos. It’s like a docker-compose file, but for a system, this is really something groundbreaking
You specify all the system and services passwords, usernames, all the stuff, your wallpapers, directories, keys, everything
And all basic configurations are already unified, so to enable some service you just need to add a line in your main config like services.nginx.enable = true; and it just works with all the bells and whistles (kind off, you can add much more. Even more than in containers)
The services are usually not sandboxes, but you can sandbox them, can even run the same containers
Sorry if you’re really not into it, it just nixos feels like a whole new lvl after podman
edit: even like that, I manage all my machines as a fleet with nixos, all from one configuration So I can basically press a button and change all the usernames on all machines and everything will continue working
Instead of adding each machine separately to a vpn, I just press a button and it deploys all the machines with wireguard and connects them all