The whole container/CM thing is kind of at a weird place right now. With containers, we've sort of migrated back to the golden image thing, just with the pressure to create an image using a config file. I don't really like images on docker hub that don't have links to the dockerfile.
Yes, images that can't be tweaked without rebuilding. It's has benefits, and a lot of caveats. Having to deploy new containers for every patch is pretty silly. And so many things can't be immutable, including the platform on which the containers run.
At the end of the day, containers are either mutable, or immutable. The former need CM inside the container, the later need it outside the container.