Sorry, but no. Resolve certs? Seriously?

I don’t care anyway if you wanna start the not an expert argument. What you linked doesn’t work either in the modern web so… No, I am out.

Resolve the content of the SSL cert? Sounds like something the CSI writers would say…

No, SSL is actually very good in preventing MITM attacks. That’s what alle the CAs are for you trust on your device.

If you can use containers always use containers as a rule of thumb. VMs are less efficient in almost every way and they add some unnecessary complexity.

For docker you basically only have to backup the persistent data. So in case of the docker setup you just have to backup the mounts and probably your compose file you are using. This probably also answers your third question already. Container files can be left alone and don’t need to be considered for backups as they should be stateless and can reside in their default location (/var/lib/docker/overlay2 or so by default).

Overall it is quite simple as you only really have to consider the mounts and the docker setup. The mounts you define and should be really obvious and the docker setup is just a few config files at most or just the compose file.