This approach is probably closest to one I would use personally, but you gotta have a lot of faith in the image maintainer to trust unattended auto-updating of an image you don’t maintain yourself. One stolen set of credentials later and your mailserver image is probably farming crypto-currency tokens for someone...

Also, this assumes that the container run arguments for the container don’t change over time. Good container maintainers are sensible about this, but you are still leaving your uptime to the chance some stranger cocks something up.

for certain homelab style applications this might even be an annoyance - if I’m in the middle of a film I probably don’t want the Plex container updating itself.