You already married to ZigBee? If not, maybe don’t. It causes 2.4Ghz interference. You’ll need to think about WiFi channels and avoid ones that overlap with ZigBee. Either that, or use 5Ghz WiFi and repeaters to make up for the lower penertration (if an issue).
Didn’t when I tried when on LineageOS. I needed that bank app for work, so got a Pixel and switched to GrapheneOS. The bank app works, and it is useful to be able to on and off Google Maps (because of traffic routing and search, when compared to Organic Maps). But LineageOS worked better. GrapheneOS has more bugs and a small community.
So teens learn about Tor & VPNs. This stuff doesn’t work. The higher you put the skills to get access, the more they will learn. Nothing motivates teens more than access to adult stuff. Maybe this is really a tech literacy policy.
Can it run problem bank apps? I need a bank auth app for work as the bank stopped fobs and it just would not run on LineageOS. It refused to run because “the phone is insecure”. I tried Magisk hiding stuff and MicroG, and a number of way of tricking methods. That’s why I ended up on GrapheneOS, as a compromise without feeling too compromised. Everything seams to think it’s on a normal Android phone, but I’ve sandboxed the Google tentacles. But it would be better if mandating OS wasn’t allowed. If I want to run a “insecure” phone, that’s my “problem”.
If it’s Stock vs iOS, do you really care about privacy? Google is a data mining ad company, that’s why their stuff is free. “If you’re no paying for the product, you are the product”. So Apple right? LOL no. Paying is no protection against being sold too. It’s closed, you’re never know, so they might as well make more money from you.
The only way is having any confidence in things is open source.
So I don’t think iOS vs Stock matters. Android is more open, but all those root level closed Google services completely compromise the phone. They owned the phone.
The problem is when Docker is used to gift wrap a mess. Then there are rotting dependencies in the containers. The nice thing about Debian packaged things is the maintainer is forced to do things properly. Even more so if they get it into the repos.
My preference is Debian Stable in LXC or even KVM for services. I only go for Docker if that is the recommended option. There is stuff out there where the recommend way is their VM image which is full of their soup of Dockers.
Docker is in my pile of technologies I don’t really like or approve of, but don’t have the energy to really fight.