I'm not a Docker specialist, I know how to install, configure and do only basic Docker hardening based on Docker official documentation.
I know nothing about AppArmor,SELinux and GRSEC.
But i need to put my C# app backend in production; My C# backend app have file upload features too.
In my case, is better to use docker and docker-compose only for not internet public exposed server/services and use Docker only more "internally" for thinks like database etc? And keep in bare metal (on host) all things that can be more critical like images and video converters, exposed servers like nginx etc?
This can reduce attack surface, i think. I'm right?