> So the NAS runs Kubuntu 24.04 with ZFS

My experience is similar. I no longer use dedicated NAS, firewall, or other exotic distributions. I run plain Debian, and add what I need through standard repo packages. My "NAS" is simply a Samba daemon. The same box runs countless other services including hostapd (WiFi), DNS (Unbound), an email stack (Postfix/Dovecot), multiple game servers, and Podman.

> everything else in Docker Compose

I would suggest Podman instead. It is far more secure by design (rootless) and is unable to silently alter the firewall's configuration.

Interesting, I never tried Podman. Thanks for the suggestion!