Not the OP.

I assume everything running in docker.

For containers: Upgrading new versions can be done headless by watchtower or manually.

For the host: You can run package updates regularly or enable unattended upgrades.

Backups can be easily done with cron + rclone. It is not a magic.

I personally run everything inside docker. Less things to concern.