> However I’m wondering if this is considered a bad practice
It depends who you ask.
I do the same at home and it works like a charm, but I have no users beside myself and my SO.
If you have paying users and SLAs you'd better get that $100/month cloud machine or have a disaster recovery plan ready (and tested).
> What security measures and other considerations would I need to keep in mind if I go this route?
the usuals... disable password authentication, configure the firewall, do not share /var/run/docker.sock with containers, don't shut down SELinux, run periodic backups and test recovery procedures periodically etc.. Normal sysadmin stuff.