Containerize by default. Run project runtimes, datastores, and tools in dedicated per-use-case Docker containers, never a host or system-level daemon. Auto-applied by the cf shim on container and provisioning changes; also invocable directly.
