Packer builds the terraformable/openTofuable templates to launch into the hypervisor where chef (eventually mgmtConfig) will manage them from there until they die.

All that is launched by git. Fire and forget. Updates are cronned.

There are no containers. Don't got time to fuck about. If Systemd wasn't an absolute embarrassment I'd not worry about updates even as much as I do, which isn't much aside from the aforementioned cancer.