Your approach won’t work if you’re behind carrier grade NAT or you can’t open ports. My landlord provides my internet so I use tailscale (with headscale on my long distance vps) to connect everything and it works great. It uses LAN when I’m home, and NAT punches when I’m elsewhere.

Entirely depends on who’s publishing the image. Many projects publish their own images, in which case you’re running their code regardless.

Yes but there are ways to protect against that. For instance you can configure Tailscale clients to only trust nodes that have been signed by trusted nodes, or something like that.

Just going to mention that if you’re okay with non-FOSS office software, I really like Softmaker’s suite (their buy-once non-subscription version).

Out of curiosity - what laptop maker is installing Sway by default?

I had a few false starts before, but MS force-updating me to the objectively worse and user-hostile Windows 8 triggered my latest (and successful) switch.

Both i3 and sway are very lightweight so you do get good performance, but it’s the easy tiling / no-nonsense looks that appeal to me.