You can run linuxserver.io images with their PUID and PGID environment variables set to run as root and rootless podman will remap it automatically to your host user without much trouble. I recommend splitting your Quadlet into multiple quadlets and pods based on application. Just keep in mind that network-wise sharing a pod is equivalent to being on the same machine. So, a gluetun and qbittorrent container can have the same network stack and communicate locally. Being on a pod an network allows you to use the container name for DNS and you don’t need to publish any ports. You can access different containers and ports pretty easily. This is where you’d want your arr apps. Publishing ports should probably be your last resort.