Depends on the approach, you can use mutable or immutable containers. In fact, the OpenVZ VPSs that were at one time reasonably popular were just containers.

Pretty much. Update the image or do the update in a container based off of the old image and package that