On another blog I read a very wise notion, which captured the underpinnings which are "wrong" with tools like ansible/salt/puppet.

You can verify that something is set, but this guarantees nothing about the things you haven't set.

Now, this is fine if you purely use the above tools as provisioning, i.e. run the configuration tools on an immutable image. However, often these configuration tools are run on long running machines. And then we're back to pets vs. cattle. With all the faults and difficulties of Docker - at least it does that right.