It won’t do much in the sense that most stuff will keep working but also in the sense that it won’t protect you from hackers coming from those countries.

So yes, you can do it, but don’t let that give you a false sense of security!

I add part of the serial number into the gpt label. Plus printed labels of that part of the serial on the drive bays.

Did you see a performance improvement going from vfs to overlay2?

I’m still stuck on vfs as I don’t want to mount my storage to the VM via NFS. Passing it into the lxc is so much more flexible and it doesn’t come with the problems when dealing with database files.

Understanding the meaning of the permissions is easy.

The problem arises when programs created by someone else make use of other UIDs and GIDs without properly documenting it.