I´m not concerned about docker.
As far as I have learned, you cannot put Apps on different network, so these kind of workaround exits: Inter-app communication in 24.10 Electric Eel
I could use Apps for my private things and put puplic ones in LXC or VMs.
Morover, I don´t want to reserve IPs via Alias, do micro management, I want to use DHCP as much as possible.
At the end is mainly a proxy like treafik and comminucation to apps is managed by docker lables through the proxy.
The only dilmena is, when I want to share the admin role, how to limit access to my Apps.
The only thing that confuses me is when I create a MACVLAN interface from an existing BRIDGE or VLAN interface on TN.
As I have different pools of apps for different network segments, I have to use VLAN interfaces.
As soon as I assign an IP address to such an interface, I open the door to the host.
I find it hard to accept that this simple setting plays such an important role in network isolation.