You should consider opnsense instead of pfsense in any case.

If by app you mean container, no. You pull the latest image and rerun docker compose. It will make only the necessary changes, in this case restarting the container to update.

Funny thing, both of those can change too. I was blond when I was a kid, now my hair is brown, and when I’m old it’ll be gray.

For a generous definition of “original”.

Edit: very generous, since it’s just new text on the second panel in https://xkcd.com/1269/