I mean, unattended upgrades has it's own config file where you can specify when to schedule a reboot (when needed), which you'd usually do in off-hours like 2 AM your local time, so changing the Systemd unit activation time seems like the wrong fix.
Edit: Nevermind, your issue was that the daemons were being rebooted, not the whole system, if I understood that correctly
As for the hardware:
If you asked me 2 years ago, I'd say they give a decent level of isolation for cheap, but, at the end of the day, in the eyes of the kernel, containerized processes are just another process running on the same host, just with a different set of privileges. If you have public facing services, or untrusted binaries, I suggest moving those to VMs, local services can stay in containers. This is what I did after Copy Fail and Dirty Frag were discovered. Alpine Linux VMs are pretty lean, so I went with that, and to keep the migration simple, I run the services as containers inside the VMs.
For frequently changing data hourly up to 24, daily up to 7, weekly upto 4, monthly up to 12.
For daily changing data daily up to 7 and etc. as above.
For seldom changing data a backup every 3 days with rotation based on a storage quota, and retention of manually held samples.
Did you read it to the end?
Without root user login, the attacker would have to guess not only the password to the user but also the username (hopefully it's not something simple like admin), and once you are logged in you can use sudo -i to chage into root, which will require a password, therefore, we also disable password login so if someone does manage to somehow compromise the SSH user, they'd still need the password to become root.
You could spin a publicly exposed WireGuard daemon firewalled to allow peers access to the non-public SSH port only, which would result in double encryption, but would give you the peace of mind that an attacker would have to compromise both at the same time, which is very unlikely. Plus, WireGuard is very cheap to deploy and produces no logs. We use that model in my office to access our server.
Edit: Otherwise, as others mentioned, you'd move the SSH daemon to a random port, disable password login and weaker keys and cyphers, setup Fail2ban, and optionally setup GeoIP blocking (only allow IPs from your region to connect).
Not in the US, at work we pay 6 times the rate I pay at home for 1/6 the speed I get at home, everyone hates our office internet speed 😂, at least it's static do we can host stuff
Either use a dynamic DNS service, as many others have mentioned and probably easiest, or, assuming you only want yourself to have access to the services, another option is to use something like Tailscale or a WireGuard/FRP instance in a static VPS as the rendezvous point.
I was flat out rejected by my ISP to have a static IP, though I only had it changed once since I started hosting services, so ahatever.
For home Wi-Fi I use a strong password, but that's because it's something I input once in a blue moon. For guests I have a guest Wi-Fi with a simpler* (still reasonably secure and random, but shorter and without special characters) password and a QR code for simple use, though they are rate limited and have no access to any other network clients.
Yep, my network was set up before the ISPs here merged by a smaller one that did things simpler, so I dont even have an ISP modem, just my OpenWRT router and no CGNAT, and I've only had my IP change once so far (since I started caring about it at least). Everything newer around uses ISP modems and are behind CGNAT, on my mates modem, they wouldn't even let him set up his Wi-Fi, he had to go with double NAT-ing and setting 2 APs next to each other (the ISP modem/router has some default trash Wi-Fi). I'm praying they never bother coming to me 🙏
None of my VM require sharing of data, so each gets their own. I don't currently use ZFS in Proxmox, but do have snapshots and periodic backups to my NAS, so recovery is generally not an issue.
Conceptually, mounting a host storage inside a VM requires the use of either virtiofsd or NFS daemon running on the host (depending whether you mount it as local or network storage), so if either of the two or the underlying filesystem has a vulnerability, it does in theory create an attack surface, which is not ideal. With that said, as I mentioned above, I have not research led this enough, since I haven't had the need yet, so don't quote me on that. At the end of the day, it's all about where you personally draw the line, so if you are fine with that risk and absolutely can't give up the feature than go for it, it's your system.