I think you got docker mixed with something else, since docker does the exact opposite, i.e. allows you run services without all of the arcane shit involved. Just put the compose file in a folder and run docker compose up -d
and you’re done, whereas the alternative would be to install a database, configure it, install the immich service, connect it to the database, write a service file for both database and service to allow it to be auto-started, and face multiple issues due to missing dependencies or permissions.
Absolutely, and in most cases (while one shouldn’t rely on this since escaping a docker container is sometimes doable) even if there is a security breach the invader would be limited to the service image, which would get recreated upon restart.