From a sysadmin perspective, I'm afraid this would lead to containers lying around with random unsupported versions of various software -- you need to rebuild t

From a sysadmin perspective, I'm afraid this would lead to containers lying around with random unsupported versions of various software -- you need to rebuild the container after every bug found, and upgrade the runtime (if it isn't LTS from the upstream) periodically, right? (however, I quit sysadmin job some time ago, so I'm not sure what the current trend is)