In-container upgrades seems to be an issue for many, we've had this issue at $work. From what I've seen, the is no consensus on the "right" way to do it. You

In-container upgrades seems to be an issue for many, we've had this issue at $work. From what I've seen, the is no consensus on the "right" way to do it. You could run the upgrades in the container and lose them when it's re-upped, or, you need to continuously deploy the containers. This alone is one major reason I'm in favour of statically linked binaries in from-scratch containers, where possible.