Yeah, so in this case the besr pratic3 here is just to start the container with the right UID / GID etc for both Haven and the other tool that he mentioned. Those should be isolated (and daemonless if possible).