Not routing all your unencrypted traffic through a company located in an dictatorship

the original tempo got abandoned by its developer

ipv6. No need to deal with hacky translation and dns bs if dont do nat.

You are pretty much as safe as it gets as long as you update that container. Ip/Port scanning basically isnt a thing in ipv6 land as youd have to scan the entire /64 which amounts to 18,446,744,073,709,551,616 addresses.