You don't actually have to care about defining IP, cpu/ram reservations, etc. Your docker-compose file just defines the applications you want and a port mapping or two, and that's it.

Example:

***
version: "2.1"
services:
  adguardhome-sync:
    image: lscr.io/linuxserver/adguardhome-sync:latest
    container_name: adguardhome-sync
    environment:
      - CONFIGFILE=/config/adguardhome-sync.yaml
    volumes:
      - /path/to/my/configs/adguardhome-sync:/config
    ports:
      - 8080:8080
    restart:
      - unless-stopped

That's it, you run docker-compose up and the container starts, reads your config from your config folder, and exposes port 8080 to the rest of your network.

If you update your OS, it could happen that a changed dependency breaks your app. This wouldn't happen with docker, as every dependency is shipped with the application in the container.

Apart from the dependency stuff, what you need to migrate when you use docker-compose is just a text file and the volumes that hold the data. No full VMs that contain entire systems because all that stuff is just recreated automatically in seconds on the new machine.

You can tinker in the image in a variety of ways, but make sure to preserve your state outside the container in some way:

1. Extend the image you want to use with a custom Dockerfile
2. Execute an interactive shell session, for example docker exec -it containerName /bin/bash
3. Replace or expose filesystem resources using host or volume mounts.

Yes, you can set a variety of resources constraints, including but not limited to processor and memory utilization.

There's no reason to "freeze" a container, but if your state is in a host or volume mount, destroy the container, migrate your data, and resume it with a run command or docker-compose file. Different terminology and concept, but same result.

It may be worth it if you want to free up overhead used by virtual machines on your host, store your state more centrally, and/or represent your infrastructure as a docker-compose file or set of docker-compose files.

Docker is still secure, it's just less secure than Virtualization. It's like a standard door knob lock (the twist/push button kind) vs a deadbolt. Both will keep 90% of bad-actors out but those who really want to get in can based on how high the security is.