https://Frame.work is another option

Multisig with paper and metal backups ( diy metal washers ). Don't ever have all the keys together unless you really need to. This is for the "hold" wallet.

Separate singlesig wallets for cache and spend wallets, backed up on paper and metal.

Hardware devices aren't wallets or backups, they are signing devices.

Podman is probably the best competitor to docker currently. Main issue is it isn't as well known so their aren't as many docs on it. It has a lot of promise though.

K8s is a massive, massive beast, I'd equate it more to a cloud than just a container engine.

I'm mobile so can't go into depth but I'll throw some things out.