The concern in this example isn't a malicious package, although that's something to be wary of. If your user account is compromised, an attacker now has root o

The concern in this example isn't a malicious package, although that's something to be wary of. If your user account is compromised, an attacker now has root on your entire machine with no additional effort. This is why people are always saying to "not run as root". When you are a member of the Docker group, you're running as root. On your production servers, that's a significantly larger attack surface for a malicious party. To get full root, they just need to compromise a user account now. That's the unforseen danger, not the packages you download. Also, this isn't Docker hate. I use it every day and am quite fond of it, which is all the more reason to run it securely ;)