I would consider time a pretty major resource....and yes, you are correct I misspoke/typed. I meant public IP, not host IP...

Anyway, the point is not to prevent all attack vectors (which is impossible, unless you're totally offline/air-gapped/etc), OP wants to minimize the probability of infiltration. So to get back to the question, yes CF tunnels help with that when implemented correctly.

You've already taken a great step by setting up Cloudflare tunnels, as that will obfuscate your WAN IP, but a common mistake I see a lot is having another random device on a network that is perhaps using a DDNS that doesn't obfuscate A records or something like that.

Basically, just make sure everything that is public/internet-facing is going through CF tunnels and you're as protected as you can (reasonably) can be - from that angle at least.

Keep in mind though, this just (largely) prevents one vector of attack - through your WAN IP - depending on your set-up, you could (and likely do) have other ways of penetration to get into your network.

I am a big proponent of getting something like a Firewalla to mitigate many other vectors. They're bit pricey (though for their capabilities relative to other "off the shelf" devices, not really, I suppose) but largely hands-off.

Well yeah, that would get your host IP...if they're doing a general scan of whole ISP IP ranges (Which nothing could really stop, except for a good firewall). But there is much more low-hanging fruit for hackers than to scan tens of thousands of unoccupied subnets.

Exactly. Even if they make it into your network (which would be somewhat unlikely already, since CF obfuscates your home IP), as long as you don't run your docker containers in "privileged" mode (or give the containers RW access to important directories on your server), you'd be fine except for the most end-of-world scenarios.

Well it does slightly more than just obfuscating your home IP, in that it will also do automatic bot, DDOS prevention, etc...