If you use something like Fedora CoreOS, the system keeps itself and all container images updated. And because system upgrades are also just a new immutable image, very little can go wrong.

I have a Nextcloud server running on it and the maintenance is negligible.

During the recent PHP-vulnerability I simply turned it off. The next day I booted it, and it automatically installed the new Nextcloud image with the vulnerability fixed.

Makes me wonder if I could have it check for CVEs and automatically shut down vulnerable containers until updated images are out.