Docker containers multiply faster than rabbits in a forkbomb. It behooves Docker to do vulnerability and malware scans of containers, because letting random peo

Docker containers multiply faster than rabbits in a forkbomb. It behooves Docker to do vulnerability and malware scans of containers, because letting random people have semi-sandboxed write and execute permissions on random other people's systems is a dangerous combination. That will cover some cases, but end-to-end personal accountability of container publishers is a necessary evil as there is unlikely a reasonable technical way to ensure there aren't malicious scripts in a given docker container. Signature-based malware scanning operates only in a limited fraction of the past since it requires submittal and review of what has been seen by a particular user AND submitted to a malware scanner publisher for analysis. Scenario: Anonymous docker publisher installs a kiddie porn i2p or tor downloader service hidden in a container for Apache Kafka. Random corporate trainer accidentially picks said container, blogs a howto with it and suggests its use in in-person and web-based courseware. IANAL but Who's liable? The end-users using it? The trainer? Docker? Disclaimer: I love Docker, but it needs some chain-of-custody assurance and greater visibility of container contents.