> That said, having ops excluded from the architecture decisions that go into building containers is absolutely antithetical to "doing devops". My point precis

> That said, having ops excluded from the architecture decisions that go into building containers is absolutely antithetical to "doing devops". My point precisely. Just because there is clean separation of concerns doesn't mean anyone needs to be excluded. The methodology I've seen work best is one where people are not divided by skillset (dev/ops) but instead by area of responsibility (app/infrastructure). Then you embed people from different functional areas into app teams: devs of course, but also security engineer, operations specialist, and various domain experts. From the point of view of IT, you're influencing the development of the app before development to make sure it follows best practices. A second important point is that, just because you're running a container built by someone else doesn't mean you can't enforce good operations practices. For example, you can mandate that all the containers on your production swarm expose health information at a specific url prefix and pass CVE scanning - or they will not be deployed.