I'm still too container stupid to understand the right way to do this. I'm running it in docker under kubernetes and sometimes I don't update nextcloud for a long time then I do a container update and it's all fucked because of incompatible php versions of some shit.
I don't remember much about how to use kubernetes but if you can specify a tag like nextcloud:28 instead of nextcloud:latest you should have a safer time with upgrades. Then make sure you always upgrade all the way before moving to a newer major version, this is crucial.