Which alternative for slirp4netns in rootless containers is better?

[sujaldev]

In the docs, here, three methods are described to avoid the use of slirp4netns (--network=host is deemed insecure so I'll just ignore that) but it does not mention any clues as to which method is suited for which task.

• When should I choose to setup the network manually as root? Or, when should I use socket-activation? Is pasta even a choice right now for containers exposed to the public internet?
• Which method is generally better from a security point of view?
• Does a container have to support socket-activation to be able to use it? If so, could you please help me understand what exactly does the container have to do to support it?

Thanks!