You can run docker stacks with external IPs, no? I run all mine from Unraid, through Dockhand as compose stacks, with some ports on the host, others as external IPs on VLANs. But yes, like you I would actually like to move them to VMs so it’s easier to backup, and service, without taking the host server offline.

It starts to get like Inception levels of depth on VMs and hosts!