Windows Containers, owing to how NT itself is put together, are incredibly awkward to use. Container images have to go all the way down to smss.exe (the NT equivalent to init), which ties you to a particular kernel patch level.

Upgrade the container host? Re-bake your container images. It's a massive pain in the ass.