I disagree on the containerization part. It can absolutely improve security a lot by facilitating isolation of namespaces and filesystems.

But perhaps base container images on scratch, not on ubuntu:latest ;)