I think that CM tools are complimentary to Docker (TV did not kill radio..), but at least some of your points do have emerging solutions. For example, ssh keys

I think that CM tools are complimentary to Docker (TV did not kill radio..), but at least some of your points do have emerging solutions. For example, ssh keys: Kubernetes has a concept of "secret volumes" that are used to distribute secrets. i.e. don't store mutable (and secret) state in the container.