Containers are terrible for bureaucratic institutions. It moves security patch management to the development org that builds the containers and development orgs typically don’t have the tooling/process to do this.

Source: consulted for a company that got bitten by allowing containers without a patch management process for vulnerabilities.