Got the Shell-in-a-Box working.  Nice product.  Other than exposing it through port forwarding, is there a way to access this from the external internet?  Or is a paid VPN the only real way to do it?

A paid VPN sets up a remote endpoint to obfuscate the real location of your machine. It does NOT allow secure access from the internet to your box. What you want is a self hosted VPN server somewhere on your network, either a plugin or docker on your unraid server, or another machine on your network, or on your router. Then you forward that single vpn port to the internet at large, and use a vpn client on whatever device you want to use outside your network to appear as if it was inside. That option is free, and doesn't rely on a third party at all.

Many routers have VPN built-in and if yours does that is probably the easiest approach.