Running a container as an unprivileged user with podman is already quite good. Even if they break out of the container, the attacker will now be an unprivileged user. You'll have to look up how to secure users in linux (I don't know how).

As for networking, that's where the firewall comes in. iptables are supposedly superseded by nftables. The easiest way to configure that is either with a GUI or with firewalld. If I'm not mistaken, basically, what you want to do is limit the unprivileged user to creating a network namespace with a certain IP range (not sure if a virtual network device is created? probably). Then you can use the firewall to say:

• allow all incoming and outgoing connections from the gateway (whatever device is exposed to the public internet through which your computer connects and receives traffic)
• block all connections outside of network namespace to IPs in your home network unless the connection was established from that IP. In other words your container won't be able to connect to devices in your home network unless those devices initiated the connection themselves

You can find more information about iptables on wikibooks. I cannot remember which table to use, but I think it's the filter table.

• rule1: INPUT chain ALLOW all from gateway
• rule2: OUTPUT chain ALLOW all to gateway
• rule3: INPUT chain ALLOW all from home network
• rule4: OUTPUT chain ALLOW all ESTABLISHED connection to the home network

Can't think of anything else. But it might help to draw a diagram with the network traffic flows.

CC BY-NC-SA 4.0