Security architect at a large enterprise here, so grain of salt with what I say as it may be overkill for your use case. First question you have to ask yourself is so what? If they completely compromise your devices, what impact will that have? Establish what your hard and soft limits are. Are you ok with your device becoming a crypto miner? If not, what controls can you put in place? e.g. CPU/GPU monitoring and alerting. Are you worried about threat actors stealing your personal data? Consider encrypting your drives and applying least privilege (don’t have a single user account). Worried they will do the favour of encrypting your drives for you? Look into off site storage.
If you are only using docker, the switch to Proxmox may give you trouble as docker isn’t supported. That said, I run Proxmox and have everything as an LXC and I think it is an excellent technology. If you stay on Docker, look up the OWASP Docker cheat sheet. It will help you to lock everything down tightly. You could also migrate to podman. Still not comfortable with the risks and controls at that point? Look at creating docker networks or a SDN. Also, log into your router. You may find that you can create a DMZ to limit an adversaries ability to pivot.
Feel free to reach out and ask more.
I’ll start again with the threat modelling. How worried are you about an adversary acting with a compromised container? Is it just fear of an attacker or are you trying to protect something specific? If so, identify that service and/or data and isolate it. Start with what you want to protect. Does it need to be on a different physical device? If not, do you need kernel level separation (VM) between systems? That separation will have overhead associated with it. Does the compute cost reduce your risk enough to justify the separation? Moving onto multiple different boxes has its challenges as well. Yes you are more segmented but do you have the network bandwidth to support the services you want? Also, do you need those publicly available services actually exposed to the internet? If you are already using wireguard, what difference does it make to create keys for your other devices to be able to access the environment? In this age of AI running rampant, reducing your external attack surface is the single greatest thing you can do to protect yourself.
Opinion time. Build on what you have and know. If you haven’t physically separated your machines yet and everything is running on docker, look into building docker networks. If you have the networking expertise and multiple devices to run things, bite the bullet and migrate to a new set of systems. From what it sounds like, you don’t have much experience with Proxmox and that is fine. Running a few Ubuntu servers with vms and containers works great as well. Look into your firewall rules. You can use AI to help you draft a firewall table. What services need to talk to what systems? Whitelist those and blacklist everything. Once you have an understanding, look into VLANs. I personally have 3 machines running on my home domain and they are separated by functionality with like 8 separate vlans woven between them. Adversaries care about home servers for two reasons (mainly): crypto mining and botnets. Your description of the hardening already manages most of these threats. Physical or virtual both work but build your controls and networks around what you want and know. Does that make sense?