

I have a directory in my home folder for all my different docker containers. I back that up like my other critical files on my NAS, Backup NAS, cloud storage and external drive. Its all scripted to happen periodically.
The docker compose files I also upload to my local Git so I can version them. Make the git ignore skip everything that isn’t a .yml
If you would want to spin them up again, yeah you could just copy them in a new place, make sure the docker-compose.yml is at the top and docker-compose pull the image, then docker-compose up. If your yml specifies that your configs are ./ , it’ll know to look for them in the same folder as your yml and begin its file paths there. Anything outside your ./ in theory should be read only or be some kind of data off a NAS that is independent from the service. Its just not best practice in my eyes for your docker application to write outside of the folders beneath its docker-compose.yml location.
Just organize your volumes correctly and you can move the docker container anywhere you want with a copy paste and a docker-compose up. Imo docker-compose is WAY easier and faster than any GUI instance of Docker.

Prevent password logins where ever possible too, especially SSH. Use ed25519 keys. Perform server actions with least privilege users, prevent root logins. Immutable systems and containers are a helpful tool too.
I also just host my public facing stuff on a VPS. DDOS protection and just otherwise isolated. 2FA on the VPS too.