Places that run tens or hundreds of thousands of machines generally really need something managing the mutable space between the base image and the container to

Places that run tens or hundreds of thousands of machines generally really need something managing the mutable space between the base image and the container to make sure things get updated more or less continuously for security patches, user access, etc. This space gets a lot thinner with containers, but doesn't disappear completely, in my experience. This is where something like Puppet comes in. I know there's the immutable infra movement, but I don't know how practical it really is to shoot every single server in the head and recycle it when a critical vulnerability comes out. Maybe others have seen this, but I haven't.