This sounds like my setup exactly, except instead of LXC/ansible, I’m using FreeBSD jails/saltstack. I completely agree about the value of isolation. You can u

This sounds like my setup exactly, except instead of LXC/ansible, I’m using FreeBSD jails/saltstack. I completely agree about the value of isolation. You can update or up-rebuild for a new os version on one service at a time - which I find helpful when pulling in updated packages/libraries. You can also cheaply experiment with a variation on your environment.