It depends. Usually the Dockerfiles are on GitHub anyway and you can take a peek, but a lot of them probably just install binaries or packages hosted elsewhere

It depends. Usually the Dockerfiles are on GitHub anyway and you can take a peek, but a lot of them probably just install binaries or packages hosted elsewhere by the company. That’s a bit harder to audit.