They could just delete the file to deny you access to your db?

My condolences! Copying the data around may be reasonably straightforward if you can get it out of the snap (it's just a directory, after all), but I have no idea how the database is setup for it. Good luck nevertheless!

I'd hope for the exact same performance with Docker (or KVM) as on a baremetal host, unless you're doing userspace networking for ultra-low latency Nextcloud :D (and even that I suppose you could PCI-passthrough the network card?)

No worries :) Let me rephrase the question though - what installation method would you be using if you could?

So far I'm reasonably happy with a baremetal installation, but considering moving it into some kind of VM.

Not using Nextcloud in snap and not sure where I said I was using it inside snap? What installation method are you using at the moment?

I have nextcloud running just fine (with Apache) on a non-443 port. What issue are you seeing exactly? Once your webserver is listening on your port of choice, Nextcloud will show an "untrusted domain" warning if the domain/port have not been set in config.php properly. After that is done, it works perfectly for me.