That&#x27;s not a &quot;security story&quot; I&#x27;ve heard before. Surely containers make this much _easier_ than traditional VMs, because containers are designed (or should be designed) to completely expendable. To do an &quot;OS upgrade&quot;, just rebuild and redeploy.<p>If you&#x27;re using a system that has rolling, verified, graceful restarts built in (e.g., Marathon, and I believe Kubernetes does, too), you&#x27;ll easily avoid any downtime, which is harder to accomplish with classical VMs.<p>With a classical system (VM or otherwise) you&#x27;ll still have to restart your apps whenever some library (glibc, ImageMagick or whatever) is patched. Docker doesn&#x27;t change that. It does potentially minimize the surface area.