They could just delete the file to deny you access to your db?

I’d hope for the exact same performance with Docker (or KVM) as on a baremetal host, unless you’re doing userspace networking for ultra-low latency Nextcloud :D (and even that I suppose you could PCI-passthrough the network card?)

No worries :) Let me rephrase the question though - what installation method would you be using if you could?

So far I’m reasonably happy with a baremetal installation, but considering moving it into some kind of VM.

Not using Nextcloud in snap and not sure where I said I was using it inside snap? What installation method are you using at the moment?

I have nextcloud running just fine (with Apache) on a non-443 port. What issue are you seeing exactly? Once your webserver is listening on your port of choice, Nextcloud will show an “untrusted domain” warning if the domain/port have not been set in config.php properly. After that is done, it works perfectly for me.