I actually am very experienced with Puppet, and I agree configuration management tools still have a (now narrower) space. But most of your concerns are actuall

I actually am very experienced with Puppet, and I agree configuration management tools still have a (now narrower) space. But most of your concerns are actually handled by what we are doing at Red Hat. OpenShift v3: * applies SELinux policies to each running container * can handle multiple styles of container upgrades (rolling, green/blue, canary, etc) * includes an automated build process for automatically patching all of your containers when there is an update to their base image (including supported releases of RHEL containers that are kept up to date with errata) * automatically reconfigures iptables as containers go up/dowm/migrate * collects metrics on all running containers * health checks for running containers to ensure they are not zombies Since it is built on top of Kubernetes, the only configuration that you need to apply/maintain is the pod description, a short json document that describes what to run, what ports to expose, etc.