Your approach won’t work if you’re behind carrier grade NAT or you can’t open ports. My landlord provides my internet so I use tailscale (with headscale on my long distance vps) to connect everything and it works great. It uses LAN when I’m home, and NAT punches when I’m elsewhere.

You will be if you call customer support and get an AI that can’t help.

Entirely depends on who’s publishing the image. Many projects publish their own images, in which case you’re running their code regardless.