It all comes down to risk management at the end of the day. And the good old equation threat X asset X vulnerability = risk.

Surprised to see this answer so low in the post! I agree; you want to reduce the attack surface and vectors as much as you can to a minimal footprint + security through layers and a good dash of obscurity

Proxmox with a bunch of ubuntu servers, plus a cloud init! All of them run docker, terraform, ansible, pi-hole, etc.