PostGIS. Geoserver documentation has the following comment:
"Shapefiles are a very common format for geospatial data. But if you are running GeoServer in a production environment, it is better to use a spatial database such as PostGIS. This is essential if doing transactions (WFS-T). Most spatial databases provide shapefile conversion tools. Although there are many options for spatial databases (see the section on Working with Databases), PostGIS is recommended. Oracle, DB2, and ArcSDE are also supported."
This isn't the whole story; even if you don't care about WFS, everything from native-sorting to the ability to create & publish PgSQL views, query performance, data security, storage...just use PostGIS.