Application updates are one part of the update routine and host updates are the other. Your Windows Docker hosts should be running a minimal operating system, preferably Windows Server 2016 Core. This version has no UI, so there's a much smaller surface area for updates, but there will still be some Windows updates that require a reboot.
Rebooting the server is an invasive process--it stops the Docker service, killing all running containers. Upgrading Docker is equally invasive for the same reason; it means a restart of the Docker service. In swarm mode, you can manage this by taking nodes of service for the update period without impacting service levels.
I'll show this with my Azure swarm. If I need to work on win-node02 ...
