Downvoting because the title says “best” and I disagree. Apple products have a bunch of drawbacks, I wouldn’t buy them even if the hardware is strong and efficient.

Sorry I still don’t understand. Did you just block typical ports?

Luckily, Hungary is not this crazy yet to monitor the sussy hosts or protocols.

What do you mean by blocking “100% of all P2P traffic”?

This won’t protect your .env files though, right?

Right, but my machine is safe at least.

It’s possible. For pnpm package cache you need to attach another volume, and another for globally installed packages.

Keep your secrets:

alias npm="docker run -it --rm -v $(pwd):/app -w /app node:latest npm"

Not enough, but better than nothing.

It’s interesting that a closed-source app has good reputation among FOSS enthusiasts. Surely they are not a Microsoft or Apple, but still who controls your computer, you or them?