I think the point of Docker (and maybe Kubernetes) is that its containers are intended to be stateless one-offs, so they aren't (and can't be) managed like a tr

I think the point of Docker (and maybe Kubernetes) is that its containers are intended to be stateless one-offs, so they aren't (and can't be) managed like a traditional server. Instead of patching a server, you'd build a new image incorporating said patches and launch that in place of the old one. It's not a bad tool for scalable services that can be stateless (i.e., not databases or file servers), even if I personally haven't quite gotten the hang of that workflow yet.