For now, I'll stick with my git-deploy-over-ssh scheme.
It is much easier/saner for me to stick with git pull && docker build. If my SSH install isn't secure, I'm screwed anyway.
If I was seriously considering switching all of my containers to Service X, rewriting it would be trivial and just a cost of doing business.
For now, I'll stick with my git-deploy-over-ssh scheme.