That is also a fine approach, didn’t think of that. I never worked with Proxmox, and had no idea i can run containers directly on it. How would restoring a container work in that case?

Example, i purchase another machine, install fresh proxmox on it, can i simply restore the containers from the original machine without any additional configuration?

I totally missed that you have an uncontainerized service. Can you run the service directly on the hardware host (safely)? If so, here's how I would probably run it considering your memory constraints:

1. Install Debian
2. Set up the uncontainerized service directly on the host.
3. Install Docker directly on the host as well.
4. Spin up the containers for everything else.

Not the cleanest/most separated answer but it would reduce the memory load of additional layers of host/VM/containers. If this isn't storing any sensitive data or being directly exposed to the internet that should be fine.

If you are dealing with sensitive data or exposing to the internet, I would consider your original plan of Proxmox VMs to separate everything but see if you can add additional RAM to help. Also consider installing something like fail2ban on every host and VM.

I do exactly that, enable nesting in the lxc container, install docker and go from there. It works great

You would have 12 GB ram shared over all the dockers. I think you will be fine. Unless everything will be used intensively continuously. But that’s my opinion. Just give it a shot, nothing to loose. Promox itself does not take so much. So if it it does not run in this setup you need different hardware anyhow.

I don’t like the solution of running docker next to proxmox, not in a vm, you want proxmox to respond even if the docker vm is busy/overloaded.

In terms of backup you should be good. I would skip that weekly local backup construction, not sure what that adds if the off site backup is working reliable. I’ld format that one and add proxmox to it and make proper use of it (like a second docker vm)