IMO—package manager outside the container. You just want the packages inside the container; the manager can sit outside and install packages into the container.