How do people automate this kind of thing, like rolling out a specific image via CI?
Generating the systemd files, copying via scp and systemd reload via scripted ssh?
For my home servers which just run personal things (like a kanban board as a todo list) I just use watchtower[0]. This requires mounting the docker socket into this container, which is not ideal.
In a production environment, id expect pinning of the docker sha and setting docker tags as immutable. Some software projects exist to scan for updates and draft PRs automatically for changes (I can't remember the name of the software but it begins with R).
Renovate maybe? https://www.mend.io/free-developer-tools/renovate/
I use it for my home server and I love it because it takes care of Dockerfiles too and version changes are saved in git, which means that a rollback is just a matter of switching back to a previous commit and rebuilding your containers (in addition to restoring a backup of your Docker volumes).
Ansible / salt / puppet, etc would do this for you in a nicer way. Or maybe Nomad.
Or k8s + ArgoCD would do that from the fact of a commit to a git repo.
As you get progressively bigger, you can consider other options.