>Because he maintains that installation and you don't?
So why is that an acceptable mentality for "in-house" developed software but if you buy something proprietary from a third party where you have zero say over what lib/langs are used, it's A-OK?
>Check for conflicts of this version of this library with other software currently in use (by other developers maybe, or even by the same developer).
That's not the case when using containers properly. Every service gets it's own environment so whatever version of lib-xyz is needed, even if incompatible with other parts of the project, are walled off for only the service that needs it.
>Add it to the watchlist on the dozen or so security mailing lists and newsfeeds he checks daily.
Ok this is where I completely agree with you as we have been working on this at our company. My personal solution seems pretty logical though so hear me out.
1) Build a docker file that fully documents the install of your service as well as any OS level dependencies. Ensure that any config files are external to the container to allow sysadmin access.
2) Document in a central location (say an internal wiki) what the external services, servers, repositories, developers, and admins are responsible for the service.
3) Automate builds of containers from repo and add automated testing post containerization.
4) Sysadmins monitor repositories for changes to docker files or wiki articles for new services, databases and libraries as well as taking note of library versions. If an issue with a particular lib or service is discovered, the config files can be edited to point to a new service. Or a new container build can be triggered with zero changes to the source code, but a forced update to the OS packages for the container.
In a tight situation where a developer might not be available on-call, the sysadmins have more control over a similar proprietary product but don't have a workflow for messing with source code (which they are likely not familiar with regardless).
There are solutions to the issues you raise (often trivial ones at that), they just require an adjustment to workflow and an increase in communication between developers and their sysadmins.