Docker needs a way to upgrade itself graciously, with minimum interruption of service. Ideally all containers would continue to function with zero downtime and zero behavior change. This might not always be possible, for example if the upgrade introduces significant changes to the container's runtime environment itself. In that case, docker should give the sysadmin maximum flexibility - in a perfect world the upgrade could be rolled out separately for each container.