Everybody does this. And, to be fair, it's a large part of the Docker experience. I recently had a pretty much identical experience with a vendor that is indu

Everybody does this. And, to be fair, it's a large part of the Docker experience. I recently had a pretty much identical experience with a vendor that is industry leading in their sector and counts most large companies among their customers. Just imagine what their cloud looks like. A supply chain attack on these guys wouldn't even be difficult, and the only reason I can imagine we haven't heard about it is that we just haven't heard about it.