Sorry - but the phusion images are unnecessarily bloated. The existence of the them has been defended by &#x27;fixing&#x27; many so-called problems that are actually no problem at all - or at least shouldn&#x27;t be a problem if you know what the hell you&#x27;re doing. No well, written software won&#x27;t spawn zombie-processes - sorry. Reaping dead child processes is something pretty basic if you&#x27;re using &quot;fork&quot;.<p>And then - a logger daemon. Guess mounting &#x2F;dev&#x2F;log into a container is too complex if you care about this?<p>Logrotate - sure, useful - but if you care about logs and aren&#x27;t sending them to your logger daemon or &#x2F;dev&#x2F;null, you probably want to store them externally - in a volume or mounted host directory - and have a separate container taking care of that.<p>The ssh server... Containers are no vm&#x27;s, if you have to log in on a container running in production - you&#x27;re doing something wrong - unless that container&#x27;s only job is running SSH (which can be useful for example for Jenkins build slaves).<p>Cron - again - same thing: run in a separate container and give access to the exact things your cronjob needs.<p>That is for me the essential thing about containers: separate everything. But sure, you could treat containers as a special VM only for one service - nobody is going to stop you. I however prefer isolating every single process and explicitly telling it how to communicate with other processes. It&#x27;s sane from many perspectives: security, maintainability, flexibility and speed.