I was in the middle of creating this slide (wrt patch hygiene) and had to stop half-way through and ask myself - aren’t we all just making this worse? 
We push immutable “phoenix” servers, and love that Docker makes that easy to implement, but unless you redeploy them, they remain un-patched. martinfowler.com/bliki/PhoenixS…
Every layer in this stack needs to be monitored, maintained, and patched. And often the responsibility for this is fractured amongst so many different groups. Who really has a joined up view of patch compliance in container-based systems?
In general, patch hygiene seems to be getting better, but I wonder if that will get worse again as more orgs embrace these platforms
A number of people asked me if Unikernels will change this. The tool chain around unikernerls seems to be majorly lacking and not something I see people using. Might be the future, isn’t the present (and I think if their time does come it’ll be behind more abstractions)
