Containerization is not a security improvement, since it strongly depends on the sandboxing (and the trends are terrible for that) Containerization frustrates validation of the installed state of the system. This means you can’t answer “how do you know” when you need to. Containerization adds a layer of unnecessary tech. I’m not saying it’s a bad thing, just something you don’t need. I say this as a former OS security guy for Unix and Linux.