You don’t. That’s not what caddy is. Use a bastion for ssh.

Edit: link https://www.redhat.com/sysadmin/ssh-proxy-bastion-proxyjump

wondered why your pet might not like particular foods?

No. It’s the same reason that you don’t like particular perfectly good foods. They’re attuned to different factors, but it’s the same process to appeal to them.

i worked at an animal hospital for a few years in my 20s (late 90s). I was also broke af punk kid living in a filthy punk rock house, barely able to afford my part of rent. So i’d bring home the pet food sometimes. It wasn’t really inventoried, and it’s nutrition. Do not recommend though, its a great way to get a bacterial gut infection since pet food regulations are very minimal.

it ranges. some cat food is indistinguishable from canned tuna. the science diet I/D canine prescription tastes exactly like canned corned beef hash. the cheap stuff (kibbles&bits, fancy feast, etc) tastes exactly like you’d expect: bone meal, corn starch, and ash slag. cause thats the filler trash the cheap stuff is made of.

generally though, most kibble just tastes like if you soaked grape nuts cereal in beef broth, and most wet food tastes about the same as canned horse. which is unpleasant.

The answer to your overarching question is not “common maintenance procedures”, but “change management processes”

When things change, things can break. Immutable OSes and declarative configuration notwithstanding.

OS and Configuration drift only actually matter if you’ve got a documented baseline. That’s what your declaratives can solve. However they don’t help when you’re tinkering in a home server and drifting your declaratives.

I’m pretty certain every service I want to run has a docker image already, so does it matter?

This right here is the attitude that’s going to undermine everything you’re asking. There’s nothing about containers that is inherently “safer” than running native OS packages or even building your own. Containerization is about scalability and repeatability, not availability or reliability. It’s still up to you to monitor changelogs and determine exactly what is going to break when you pull the latest docker image. That’s no different than a native package.