The container should always be updated to march production. In a non-container environment every developer has to do this independently but with containers it only has to be done once and then the developers pull the update which is a git style diff.

Best practice is to have the people who update the production servers be responsible for updating the containers, assuming they aren’t deploying the containers directly.

It’s essentinally no different than updating multiple servers, except one of those servers is then committed to a local container respository.

This also means there are snapshots of each update which can be useful in its own way.