I never said you need or should have the package tools inside your container, but you do need to be able to track the lineage of what was put into those contain

I never said you need or should have the package tools inside your container, but you do need to be able to track the lineage of what was put into those containers so you can easily search for ex. deployed container revisions with an out of date Java version. This is where you need a team devoted to build that creates this kind of infrastructure. Otherwise, you end up with difficult to answer questions about your infrastructure. tl;dr I assume there's some control because there should be.