It's always been surprising to me how little people seem to care about the provenance of their images. It's even more surprising that infosec isn't forcing developing to start their images `FROM scratch`.
Ther's always a certin level of trust, and for many, docker containers are just as trusty as distros from trusty orgs or volunteers.
You are in control of the entire supply chain with Nix.
As a matter of fact, yes.
How many systems on chips are in a moderen computer, not the main system and cpu, but every little chip and controller, the boot system, every board seems to have a little OS.
In regards to security, its all about analysing risk and trade-offs.
For me using containers from known vendors is a risk im willing to take.
Not even close. Very few courses require anything that advanced and only some of those are non-optional.
And some (very rare) companies do enforce that, everyone else has to build up a bit of trust.