We're talking about fixing the underlaying images to a fixed point, not about baking in secrets into the image. And there are plenty of uses for using propriet

We're talking about fixing the underlaying images to a fixed point, not about baking in secrets into the image. And there are plenty of uses for using proprietary images. For example, I have done workflows where the properitary code is layered on top of open-source code. (Although if I were to redo those CI/CD pipelines again, I would use the de-facto buildpack standard instead; even then, the buildpack slug itself would be properitary and requires an artifact store of some kind). Either way, using GCP or AWS registry that integrates with their IAM systems works well. The newer versions of docker contains a plugin system, so both GCP and AWS command line tooling can hook in their own authentication mechanisms in there.