I asked Alan the Ubuntu community manager if he had insights into their setup and security concerns, he said:

<popey> In short, do what upstream supports. I setup a discourse recently which I did using digitialocean and the upstream install process, which indeed is inside docker
<popey> ( I haven't read that thread yet, just voicing what I did recently )
<popey> If you want support when things break, it's best to install the way upstream recommend, which is docker
<popey> Also, tiny tidbit, the Ubuntu Desktop team completely shutdown the ubuntu desktop mailing list and moved to discourse. 
<popey> We get so much more engagement with the community now. Especially as we use Ubuntu SSO for sign on.