I think you're jumping through hoops that you don't need. Whether cockpit uses fail2ban or not is a good question, but as for whether you should put cockpit's port 9090 directly on the internet, or wrap it in an ssh tunnel ... why? Cockpit registers itself as a system pam module (see cockpit docs) which means that when you interact with the cockpit login ...
ECDH is for key exchange (EC version of DH)
ECDSA is for signatures (EC version of DSA)
Ed25519 is an example of EdDSA (Edward's version of ECDSA) implementing Curve25519 for signatures
Curve25519 is one of the curves implemented in ECC (most likely successor to RSA)
The better level of security is based on algorithm strength & key size
eg. Ed448 ...
I would keep using openssh
Assuming a 'normal' server, with no resources problem but only about concerned about the security benefits, I would keep using openssh.
It has an excellent security record.
While the list of CVE is a long one, analysis shows those are -particularly for one-user servers- actually relatively minor. Those not covering DDoS mostly go ...
It's important to note, when considering container security, that standard Linux containers are literally just Linux processes with some isolation techniques applied to them.
There are security considerations relating to them, but they're really similar to what you would have for any other process running on a host.
In this case, when you mount files inside ...