No, I strongly disagree. Ac2 definitely wrong choice.
I use containers for VPN tunnels (clients only) on 4011, ax2, ax3, ac3.
All with internal flash except of ax3.
Ac2 - worst device ever in terms of containers. Had a several days of a struggle with external usb flash.
It just hangs after half of day of very unstable work.
It was an early version with 128 ram, most of ac2 has got 256.
The only packages I had : ros 7 + container.
Ac2 should be thrown away as total garbage.
Top performance (cpu usage for mangling and vpn tunnel) - 4011, then ax3, then ax2. The slowest one - ac3, it has got usb , but its slow comparing to ax2.
I think ax lite should be ok.
Its cheap if you buy it used and its capable of containers.
Also, avoid of buying hex refresh, as it has got another incompatible arm v5, which is not compatible with other.
http://forum.mikrotik.com/t/issue-with-container-not-working-on-new-hex-refresh-e50ug/180198/1