You do. It automatically reboots after applying rpm-ostree updates.

You’re right and I’m not saying that I recommend settling it to permissive. You should understand the risks involved.

I’ve been using Fedora CoreOS as my main server in my home lab for a couple years now and have been very happy with it. You still get the convenience of automatic atomic updates and you also have the flexibility of being able to install whatever additional Fedora packages you need with rpm-ostree.

I installed Docker Engine and docker-compose from upstream. You should be able to set SELinux to permissive mode if you need to so it doesn’t enforce any policies.

Tailscale. Use Headscale if you prefer self hosting over using their cloud service.

There’s Headscale if you want to avoid the Tailscale cloud service.