Follow
> Running a separate container for a small program like certbot seems pretty ridiculous to me
Because it is ridiculous and not only for a "small program" but for any daemon that is available as a regular package.
It does make sense if you have a custom application with incredibly complex dependencies that you just can't cleanly install in the operating system.