Do you keep your docker containers running 24/7, or spin them up before they are needed. For example, I use BentoPDF maybe three times a week. So I've gotten to where I down the container after I'm done using it. The only containers I leave up, are my “infrastructure” apps... vaultwarden, radicale, WireGuard, NPM, Jellyfin.

Given that most images have unresolved CVEs, reducing exposure, is just another security layer. As well it frees up memory, and reduces CPU load, and the power that requires.