but, where does it pull them from ? who's hosting the images ?
They default to docker compatibility, so if you specify 'busybox' it will pull your default registry, which defaults to dockerhub. If you specify 'k8s.gcr.io/etcd-amd64', then it will try to pull from google cloud registry.
You can redirect such urls to a different registry if you prefer, by using the containerd mirrors configuration.