1) yes, docker containers are immutable. The pain comes more from updates that are around them 2) Trying pyinfra. Thanks for pointing it to me ! Looks promising indeed :)