Anything that ends the bullshit one has to put up with with private trackers is a boon

I’m always very wary of systems that require a user to deviate as much from the “usual” structure almost all other services use. HAOS has really weird configs and “all the functionality” that presumably breaks when you use docker and don’t have the supervisor for docker… well… If what HA did was the way to go… whi is it that tons of services use docker’s rather powerful internal networking features just fine but HA of all things can’t do that and requires weird addons that for some reason cannot live on any other system than a Debian with weirdly specific modifications (bye bye cgroupsv2)? This will break most other functionality of that host Debian. I mean… if only there was a widespread-way to provide a highly customized Linux kernel in an ephemeral environment that can just be plugged in and out of a host machine without changing the host machine itself… Nah, can’t have that, let’s cause more overhead with a VM…

I’m not willing to make that kind of modifications to my whole setup just for HA and in the long run, this rift between “the way it’s usually done” and “The HA-Way” will become bigger and bigger, causing more and more problems.

Nah, but I live in one of the cities MAN is named after. No that this would mean anything, but hey… :P

More like working in symbiosis

You can ditch the first sentence there.
Zip ties is always the solution. Period.

Okay, I think we can wrap this up: OP started with “I don’t want to be convinced of the predominant oppinion about security” and kept their word.
OP: You got your answer. There is no alternative to ClamAV. ClamAV is open source so it will always be slower than apt update in fixing vulnerabilities.
You can wonder why the whole community that created tons and tons of cool shit for Linux with armies of talented people with way more IT knowledge than all of us combined didn’t dedicate their time to Viruses. You can ask yourself how a virus would even get on your server… or you can not. Your choice. But the answer is: There is no alternative to ClamAV and ClamAV is set up mainly to detect Windows-Viruses that get spread by Mail-Attachments and the like.

For everyone here: I decided on restic and wrote a little script that backs up basically all docker volumes after stopping all containers. Now I just gotta collect and save all relevant docker compose scripts somewhere (and incorporate all the little changes I made to the containers after deployment)