

I would reconsider docker because if a specific application leaks some sort of shell access or system file access you’ll be protected out side of container host escalation.
Unrelated to security, I prefer docker because it leaves the server very clean if you remove different apps. Can also save time configuring more complex applications or applications that conflict with system libraries.
Add fail2ban on your list of applications it watches logs for invalid logins and puts them on firewall block rules after so many failed attempts.
Opensearch will be the most performant. Anything sql will likely start to stumble with lots of stories or really long stories where this is exactly what lucene based search engines (solr, elastic, opensearch) are designed to do. Could an SQL solution solve your problem, yes, but it may be a bit on the slow side as your amount of stories and size grows.