I can't recall the specifics, but keep running into issues when setting up port forwarding, attaching networks, etc. where I end up chasing the reason things don't work down to "docker inspect"-ing things. Usually it's some step I missed or overlooked, but the state I'm in just doesn't do anything useful. It makes sense I end up in that situation because I'm using something that maps to docker commands. I guess I expect a PaaS solution to own more of the system and tell me something like "the way you try to proxy doesn't make sense with the container you spawn", or "you added a network to attach to, and made other changes, the app will be restarted to apply it".

To be clear, I didn't want to say Dokku does things wrong. I'd like something that can validate changes and expected state. But if Dokku is supposed to be a "thin layer", that's cool.