At the company I work we have not opened up Docker Hub and are looking at the best way to manage and also provide security.
It's no different than trusting code in a 3pp library. I'd vet the code before running it. In some cases, you are giving the running container root access to your computer. Take a look at the Dirty Cow to exploit that allows you to break out of the container and control the host.
https://blog.paranoidsoftware.com/dirty-cow-cve-2016-5195-do...
You never know what people will put into their images. I built a tool to help reverse engineer images to find files people put in their images here.
https://github.com/P3GLEG/Whaler
I have found so much weird stuff that people build into the containers. I wouldn't trust them implicitly because it's a packaged black box.
In the short term I can probably convince the higher-ups that if I download the images manually and do some level of investigation using a tool like yours then it should account for some security.
Have you considered container scanning tools?
I only knew about https://microbadger.com/ until now, but Whaler puts out more info.
Do you know if it's possible to reverse engineer the entire source code of my app from the Docker image?
It’s not unheard of for Docker images to be backdoored or tampered with, just look at last month - https://arstechnica.com/information-technology/2018/06/backd...
If they’re trivial images, maybe mirror them internally and walk through their internals if that doesn’t consume too much time.