I am keeping it verrrrrry simple. I build images, on a cadence. But those images, have a life of their own once they are running because they have systemd scripts and golang agent processes, that manage things in an efficient way (like updating in place, or renewing certificates, and managing the whole proxy control plane). Persistent data is saved to a place that is outside the image so for 'manual intervention' it's always possible to terminate the running image, and launch the new one while keeping the data and configs. Software like haproxy, automatically manages app servers for example, so when they update they are removed from the pool, and then added back after they have updated.