I run HA in docker. Configs are in a volume mount and get backed up with the other zfs datasets (I'm sure you could put them in git too..). Extensions work fine but sometimes you do need to run another docker container, eg zwavejs2mqtt. All that stuff lives in docker compose files in git.
They have moved to be UI based, which does seem to work much better for most users given how complex automations can get.
I agree. First I was pretty heavily against moving a lot of the configuration into UI. But I've embraced it since then. It makes it less "pure", sure, but it's so much quicker now to get things done in my experience.
It works without host access. It's just that to auto-detect devices on the subnet requires low level access across several protocols. Perhaps this could be done without host access but it seems to be a difficult problem.
No, it doesn't work without. Auto-detection is one thing, even that can be NAT'ed, definitely not difficult - bridging broadcasts between subnets is an OLD thing. But I digress, I'm actually speaking of all the integrations that foolishly assume the bind IP and the advertised IP are the same. So it's either an invalid bind address or an inaccessible internal one.
Mine is running with normal isolated networking. Z-wave and zigbee are both working fine. No integrations that don't. I think I originally had to assign the hue bridge to have a static ip though..
Neither Z-wave or ZigBee are the type of thing that would have to be directly visible on your local network to work properly. Try Homekit or something that has actually uses IP networking.
They have moved to be UI based, which does seem to work much better for most users given how complex automations can get.