When you put it that way, I agree - a password manager should really be implementable as a single statically linked binary.
There seem to be some other Docker features used, like healthcheck [0], and MariaDB seems to be installed, too, so it might be worth considering how much additional OS-dependent complexity would the equivalent functionality without using Docker require. At the very least, you need some kind of service manager to run your program on boot, and restart it on error. At that point, Docker may as well be used as a glorified service manager - just slap your static binary in a `FROM scratch` container, and you're done.
> I am not a fan of this kind of redundancy and opaqueness.
Me neither. But I wouldn't blame Docker itself - it's just a tool. If it wasn't for Docker, some other way of circumventing good engineering would be found :-)
[0] https://github.com/dani-garcia/vaultwarden/blob/main/docker/...
