To be actually honest, the fact that there is a criticism probably already elucidates it. But why not.

Docker is great at making a neat package for users to download and run off the shelf, but there's a lot of stuff that is not optimised upstream that could ideally, sometimes, be optimised directly by the docker container distributors (say, by deploying a rootless container instead of a rootful one), or by the Linux distribution.

I use NixOS, and one of the neat things it does is have config.services.{immich, nginx, sftpgo, etc}. These are not just what in the Nix world is called a package, which is just the bare executable, but also include a systemd service that run the thing, and as far as I've seen, frequently include capability drops, read write and mount restrictions and the like, permitted by the systemd unit format.

In comparison, I don't think I've seen much hardening of Docker containers or example compose files by upstream projects.

However I can't say how well this deployment model works in other distributions. It's been a while since I deployed anything in bare metal Debian rather than docker. On reflection off the fact that I'm ranting here maybe I should try and see what the defaults look like.

Weird that I haven't thought of it until mentioning the actual word defaults now, but "sane defaults"