Habitat.sh seems to solve all your concerns. It's a clean room build tool that runs a supervisor on pid 1 of your containers and enables them to be configable, plus lots of other goodness that answers "how do we manage containers after day 1" style problems.