The whole stack start/stop is huge. It was my biggest issue. Looking forward to giving this a spin.

Securityonion is a great ids system. I used their distributed system, so I have 1 mini pc as a sensor and another as a manager/search. Works wonderful.

I have all my docker containers in a vm and then anything not docker in a lxc. For a while I didn’t have issues with docker containers in lxc and then they all stopped worked every time there as an update so I moved them to vms.