Filtered dns provided via opendns.com is a damn good/easy option. Not 100% but will take care of most junk that may accidentally pop up. If they are smart enough to get around that, I feel they are old enough to understand the concept and consequences of sexual intercourse.

It may be from it being ran on SQL Light. You can and should setup with a dedicated SQL server instead. From my experience it’s quite snappy as long as the docker container is ran off of SSDs.