It's always been surprising to me how little people seem to care about the provenance of their images. It's even more surprising that infosec isn't forcing developing to start their images `FROM scratch`.
Ther's always a certin level of trust, and for many, docker containers are just as trusty as distros from trusty orgs or volunteers.
How many systems on chips are in a moderen computer, not the main system and cpu, but every little chip and controller, the boot system, every board seems to have a little OS.
In regards to security, its all about analysing risk and trade-offs.
For me using containers from known vendors is a risk im willing to take.
Not even close. Very few courses require anything that advanced and only some of those are non-optional.
You are in control of the entire supply chain with Nix.
As a matter of fact, yes.
And some (very rare) companies do enforce that, everyone else has to build up a bit of trust.