Ideally, the box should only have access to a few internet sites, all the rest being blocked and logged.
For instance, access to Debian repositories, ClamAV updates, rspamd repositories, etc.

• A whitelist / blacklist proxy, like tinyproxy might be enough.
• Adding appropriate firewall rules to automatically redirect the traffic to the proxy might be interestin

I might have missed some documentation (or just knowledge of docker best practices and how to apply them) but...

What's the best way to add plugins to roundcube with this setup, so that it will survive updates, migrations etc?

I'm particularly interested in things like keyboard shortcuts, contact sync etc, but I expect if there's a "containery way" it would apply to all plugins.

It would

# certbot certonly --webroot -w /srv/www/htdocs -d $MYHOSTNAME
Saving debug log to /var/log/certbot/letsencrypt.log
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel):XXX@XXX.de
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org

-------------------------------------------------------------------------------
Please read the Terms of Se