OS updates (updates to files inside containers) would be on a per-container basis. Kernel upgrades would affect all of the containers running under that kernel

OS updates (updates to files inside containers) would be on a per-container basis. Kernel upgrades would affect all of the containers running under that kernel (machine or VM) at the same time. Though, if you wanted to be super cautious, you could upgrade kernel on an empty container host (quite easy if virtualized) and migrate containers to it and test them on an individual basis.