Ideally, the CICD pipeline that generates your container images should be considered part of the running infrastructure for as long as the system is in operatio

Ideally, the CICD pipeline that generates your container images should be considered part of the running infrastructure for as long as the system is in operation. Alternatively, it's fairly painless to build a new container image with the legacy container as the base image. Containerized infrastructure is not for the faint-of-heart. If you don't have a mature CICD pipeline and associated processes—and the staff and organizational awareness to maintain them—you're going to have a bad time. You need to anticipate rebuilding your containers on at least a monthly basis due to security updates in your upstream images. Though this isn't much different than non-containerized infrastructure—your system upgrades just happen at the build phase rather than the post-deploy operations phase.