Most people build their own images using CI/CD to their own registries when using containers in production [1]. You don't really otherwise know what is in them.

Most people build their own images using CI/CD to their own registries when using containers in production [1]. You don't really otherwise know what is in them. And for on-laptop hacking it's just a docker build command. [1]Especially now that public docker hub is ip rate limited to uselessness.