I run ssh for git inside a "from scratch" container with the git binary running unprivileged as an application. There is no need to interact with the host opera

I run ssh for git inside a "from scratch" container with the git binary running unprivileged as an application. There is no need to interact with the host operating system. Backups can be handled by a backup container. If the host OS is stateless, there is nothing to backup. All you care about are data volumes, which you can then use any automated container daemon backup solution for. A very well solved problem. For rotating https certs, there are endless letsencrypt containers that automate that for you too. The point is you do the work for what you need up front, once, and then you don't need much work to keep it maintained.