If you have a VM, there is no need for docker.
Start by installing ssh.
Enable public key auth.
Disable password authentication.
Set up fail2ban with ssh.
Set up ufw.
Set up nextcloud.
Avoid hosting your own mail, that’s another level of complexity. If you really need it, try mailcow.
If you have all that and didn’t touch a GUI on your way, you’re good to go.
If you have a VM, there is no need for docker. Start by installing ssh. Enable public key auth. Disable password authentication. Set up fail2ban with ssh. Set up ufw. Set up nextcloud. Avoid hosting your own mail, that’s another level of complexity. If you really need it, try mailcow.
If you have all that and didn’t touch a GUI on your way, you’re good to go.