At the company I work we have not opened up Docker Hub and are looking at the best way to manage and also provide security.
It's no different than trusting code in a 3pp library. I'd vet the code before running it. In some cases, you are giving the running container root access to your computer. Take a look at the Dirty Cow to exploit that allows you to break out of the container and control the host.
https://blog.paranoidsoftware.com/dirty-cow-cve-2016-5195-do...
You never know what people will put into their images. I built a tool to help reverse engineer images to find files people put in their images here.
https://github.com/P3GLEG/Whaler
I have found so much weird stuff that people build into the containers. I wouldn't trust them implicitly because it's a packaged black box.
Do you know if it's possible to reverse engineer the entire source code of my app from the Docker image?
In the short term I can probably convince the higher-ups that if I download the images manually and do some level of investigation using a tool like yours then it should account for some security.
Have you considered container scanning tools?
I only knew about https://microbadger.com/ until now, but Whaler puts out more info.
It’s not unheard of for Docker images to be backdoored or tampered with, just look at last month - https://arstechnica.com/information-technology/2018/06/backd...
If they’re trivial images, maybe mirror them internally and walk through their internals if that doesn’t consume too much time.