First thing is to understand your attack vectors. How could you be hacked?
We use VMs and dedicated servers, they are in a VLAN at a hoster, with an “external” firewall.
Personally I feel there are a lot of bigger risks: what happens if your reverse proxy has a bug and an attacker can take over the container. Does the container run with a restricted user? Is it up to date?
Is the Docker Socket mounted into the container, is it only readable (:ro won’t do!), is access limited? Is a docker-socket-proxy used? Then it’s another attackable component, is the source, code and build pipeline trustworthy?
What about the application? Can a attacker take over the container? Restricted user? Is the user auth working? Is the code correct? Can an attacker see more through additional parameters passed?
In general I think that the Docker ports are pretty secure, not sure if fail2ban is supported, but there are a lot of other risks.
Check this post for further reading.