For whatever it is worth to you I've hardened my jellyfin docker compose this way. I'm obscuring some things in this that are local to my network.

The container is read only. It mounts the media read only. It should be fairly isolated from getting privileges it shouldn't have. The only things lost in this setup are the ability to delete media from a jellyfin client (something I never do) and the ability to manipulate files directly stored with the media. I use bazarr for subtitles so don't need jellyfin to download them and I don't keep trickplay or any other jellyfin metadata related files alongside the media. I feel pretty confident with this that even if the jellyfin codebase had a serious 0 day that the worst I'd lose is metadata and server setup, and important config files I have backing up to another machine.

I'm sure there's things I've overlooked with this setup so I'm very open to being told there's a better way to do something.

services:
  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    restart: unless-stopped
    user: ${PUID}:${PGID}
    group_add:
      - "992" # my render group id
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    networks:
      macvlan:
        ipv4_address: OBSCURED
        mac_address: OBSCURED
    healthcheck:
      test: [ "CMD", "curl", "-fsS", "http://127.0.0.1:8096/health" ]
      interval: 1m
      timeout: 10s
      retries: 3
      start_period: 30s
    environment:
      - TZ=${TZ}
      - JELLYFIN_PublishedServerUrl=OBSCURED
      - TMPDIR=/transcode
    volumes:
      - ./jellyfin:/config
      - ./cache:/cache
      - ${MEDIA}:/media:ro
      - ./transcode:/transcode # be sure to set this dir in the jellyfin config
    devices:
      - /dev/dri/renderD128:/dev/dri/renderD128
    deploy:
      resources:
        limits:
          memory: 5G
        reservations:
          memory: 3G

  watchstate:
    image: ghcr.io/arabcoders/watchstate:latest
    container_name: watchstate
    restart: unless-stopped
    user: ${PUID}:${PGID}
    ports:
      - 8180:8080/tcp
    volumes:
      - ./watchstate:/config

networks:
  macvlan:
    driver: macvlan
    driver_opts:
      parent: OBSCURED # Replace with host network interface name (find via: ip route | grep default)
    ipam:
      config:
        - subnet: OBSCURED # Your local LAN network CIDR
          gateway: OBSCURED # Your local router IP address

Better to just turn the phone off if you're in the power menu anyway. On boot up the phone requires a non-biometric credential to decrypt it.

While the truth of the report is up for debate, a newspaper reported that the first public appearance of a top hat (invented by one John Hetherington in 1797) caused such a commotion that he was arrested for breach of the peace after ‘several women fainted at the unusual sight’:

https://blog.britishnewspaperarchive.co.uk/2014/01/15/the-first-top-hat-causes-a-commotion/

A Tale of Legendary Libido (2008), it's Korean.

There hasn't been a need for a dedicated QR code scanning application on Android or iOS for years now, it's just a feature of the camera application.

You cannot build up an immunity to cyanide. The mechanism of action for it to act as a poison is that it directly limits aerobic respiration on a molecular level. To put that more simply, it stops oxygen from getting where it needs to go and effectively stops your cells from "breathing", ultimately stopping your mitochondria from functioning. To put that in a more complex way, it binds to part of an enzyme called cytochrome c oxidase that is essential to ATP synthethis and prevents the reaction from occurring.

Horrifyingly, cyanide poisoning cannot be fixed by simply giving the body higher concentrations of oxygen to breathe in. It doesn't prevent your repository system from uptaking oxygen. Instead it prevents your individual cells from using the available oxygen.

While it is sort of technically possible in the case of cyanide for the liver to produce more rhodanese (an enzyme that specifically reduces the toxic effects of cyanide in the body) the reaction is dependent on sulfur. Perhaps if you ate foods like eggs in very large quantities and also regularly ate larger amounts of cyanide you could maintain a state of immunity to doses larger than what would normally kill a person but I can't find any evidence of someone stupid enough to test that. Regardless this immunity is in the form of getting your liver to simply clear the cyanide from your system faster and does nothing to stop the underlying cellular asphyxiation.

As an aside Arsenic which was also mentioned earlier interrupts mitochondrial function as well, but in this case it takes the place of Phosphorus (The P in ATP) and the resulting molecule is not able to react correctly. While not a perfect comparison you can think of cyanide as starving your cells of oxygen while arsenic starves them of useful fuel. Neither of these are something you can build an immunity to.

It could be worth trying to run it using Proton instead of just stock WINE. Obviously no guarantee it would work but there's a lot that's been put into the Proton project to make games work better and something like a custom cursor seems in the realm.

https://github.com/Open-Wine-Components/umu-launcher

I'd try it in the umu launcher project.

Am officially maintained Docker image is no less a security concern than an officially maintained apt repo. Depending on how you set up a container stack it can even be more secure. An attacker gaining root access to a container that you've given extremely selective access to the host machine is far better than them gaining root access to your actual system.

Proton is Valve's specific fork of Wine. The launcher sees you using Proton while detecting controller buttons and then connecting that you're on a Linux handheld.

https://opencut.app/