“immutability” doesnt really make sense it the context of the container. like, if you want to change the image, just make a new one with whatever changes you want and boot that.
in my opinion, it doesn’t make sense to change the whole base OS image just to install some random package or program. keep that in the user writable domain, or userspace. not in the base OS image.
its even better to just think of it as a container image.