Thanks for the long reply. Sadly I don't know enough about unix sockets and docker/podman networking to help you.

I've only used unix sockets with postgresql and signald. For both I had to mount the socket into the container and for the postgres I had to change the config to use unix sockets.

how do I programmatically programmatically utilise sockets for containers to communicate amongst each other?

Sockets are filesystem objects, similar to a file. So for 2 containers to access the same socket, the container exposing the socket must export it to the host filesystem via a bind mount/volume, and the container that needs read/write on this socket must be able to access it, also via a bind mount. The user ID or groups of the user accessing the socket must be allowed to access the socket via traditional unix permissions.

Again, I personally do not bother with this, I run the reverse proxy directly on the host, and configure it to forward traffic over HTTP on the loopback interface to the containers. [1] [2] [3] and many others lead me to think the risk is acceptable in my particular case. If I was forced to do otherwise, I would probably look into plugging the RP into the appropriate podman network namespaces, or running it on a dedicated host (VM/physical - this time using SSL/TLS between RP and applications, since traffic leaves the host) and implementing port forwarding/firewalling with netfilter.

I have a few services exposing a unix socket (mainly php-fpm) instead of a HTTP/localhost socket, in this case I just point the RP at these sockets (e.g. ProxyPass unix:/run/php/php8.2-fpm.sock). If the php-fpm process was running in a container, I'd just export /run/php/php8.2-fpm.sock from the container to /some/place/myapp/php.sock on the host, and target this from the RP instead.

You need to think about what actual attacks could actually happen, what kind of damage they would be able to do, and mitigate from there.

how I can automate the deployment of such proxies along with the pods

That's a separate question. I use ansible for all deployment/automation needs - when it comes to podman I use the podman_container and podman_generate_systemd modules to automate deployment of containers as systemd services. Ansible also configures my reverse proxy to forward traffic to the container (simply copy files in /etc/apache2/sites-available/...; a2enconf; systemctl reload apache2). I have not used pods yet, but there is a podman_pod module. A simple bash script should also do the trick in a first time.

The traffic between containers should not be done over your normal network, you should set up a private network between containers. That way it won't matter if it's not encrypted.