See if a light weight kubernetes installation is for you. Secrets are first class citizens in k8s. You can maintain secrets in a number of different ways, but they are exposed to containers the same way. They can become files or environment variables, whether you need.
I recommend looking at k3s to run on your Pi and see if that works for you. You can add vault software on top of that later without changing your containers.
That’s a great tip! It turns out I must have already tried some of that. I found multiple settings in about:config. Anything with a file picker works (open, save as), but the “open folder” from the Downloads dialog must just not use xdg-open, since none of the settings had an effect on that. It’s not the end of the world, but it would be nice to have my Dolphin bookmarks and places.
Edit: Adding this here in case someone in the future finds this searching for the problem. It looks like I’m bitten by the bug described in comment 55 (near the bottom) of this Firefox bug report. TL;DR: it works if I have Dolphin open already, but if not, it starts Nautilus. While this isn’t great, at least I have a workaround.