Networking - Which app In & Out of the Service:Gluetun

Hello All,

I am trying to work out when i should 'include' a container, or exclude it. What logic do you use?

Apps like Sonarr and Radarr dont seem to directly do any P2P over WAN so could be out?

Homepage, I tried to configure as Bridge, then exposing the HTTP 8000 port for Gluetun but this didnt work, so needs to be in the Service:

Flaresolverr? In or Out

Would you make any changes to the container networking below? I have two considerations:

As VPN bandwidth is obviously more restricted/limited than my WAN, so keep things optimised.
Also, there is an inherent risk with the Service: networking from my understanding that it is essentially a local network with all ports open between each container.