This is interesting, but... how does one deploy this in a container without k8s (using Docker)?

Keycloak is big and complicated, but at least it's easy to hide all the complexity behind Docker. Other than configuring the database, one could treat it as an opaque blob.

Authentik is big and complicated and modular, so the complexity is apparent in the `docker-compose.yml`.