Worked like a charm. Remember to take backups beforehand in any case!

Check out the krun runtime for podman, if you want stronger container isolation from the host. It creates a small VM for each container. Gpu passthrough on linux is limited though.

Sorry for not answering to your question directly, but why not just use subuids for separation instead?

podman run -d --restart unless-stopped \
  --uidmap "+0:@100001:1" \
  --name nginx-1 \
  --port 8081:80 \
  docker.io/library/nginx

podman run -d --restart unless-stopped \
  --uidmap "+0:@100002:1" \
  --name nginx-2 \
  --port 8082:80 \
  docker.io/library/nginx