> We should build a new container after each apt-get for security patches, right? Yes. That's the idea. Here's when and why you re-deploy: * A new, upda

> We should build a new container after each apt-get for security patches, right? Yes. That's the idea. Here's when and why you re-deploy: * A new, updated version of software/a package is out. * You've made changes to your app. Even something as simple as a typo. * Your container has been up too long (e.g. 24 hours). Replacing existing containers multiple times a day in a production environment is the norm. "The only constant is change" and the more often things change the more often you'll be swapping out your containers for new ones. The whole point of containers is that they can be brought up and down in an instant without impact (if you architect things correctly). So even a VM that runs "apt-get update ; apt-get -y upgrade" every night may not be as up-to-date or secure as the same software running inside a container.