I highly recommend https://github.com/mother-of-all-self-hosting/mash-playbook for those interested in secure containerized self hosting.

A tremendous number of services are supported

non-root user execution, read-only, and cap-drop where possible