I agree that security should have been in place before they went 1.0. However, if you look at the work on the version of the registry (docker/distribution on gi

I agree that security should have been in place before they went 1.0. However, if you look at the work on the version of the registry (docker/distribution on github), they are taking things more seriously and trying to get the basics right. I find your last point a bit strange. We all know the Docker development experience is a lot better than raw lxc. I'm saying you can (and probably should) be more careful about provenance than the Docker Hub is. Note that there are alternatives to the Hub with better provenance stories e.g: https://access.redhat.com/search/#/container-images https://access.redhat.com/search/#/container-images (from https://securityblog.redhat.com/2014/12/18/before-you-initiate-a-docker-pull/ https://securityblog.redhat.com/2014/12/18/before-you-initia...) This might make things a bit more awkward than it was before, but it's still not the same as raw LXC. I feel your anger and I think it's understandable, but that doesn't mean things won't get better.