Agreed, and what you're saying is really the proper way do things in a cloud-native environment where all hosts are ephemeral, containerized apps are idempotent

Agreed, and what you're saying is really the proper way do things in a cloud-native environment where all hosts are ephemeral, containerized apps are idempotent, and especially a serverless environment where no one has access to the invisible host. However, for anything shy of full serverless, just s/developer/ops and you still have to solve for the same problem. At the end of the day you're always going to want someone to be able to get a shell on the box for troubleshooting some critical issue. If there is a box.