> Every layer understands the command it was run in the Dockerfile to create itself

How reliable is this? Can it be modified after creation by a malicious party?

That is, if I get a wild docker image, can I trust the results of `docker history`?