Comment by ldng

It is not necessary. You probably achieve similar results with ansible+selinux+vpn I suppose.

But it has its uses. For instance, putting all your services in a private network and only expose port 80 and 443. Images gives your reproducibility even when your build system is not. The image validated is the one deployed. Disencentive hand editing in prod ...

Basically nothing you can not do you yourself. It just simplify (and potentially accelerate) some deployment processes.