Comment by sneak

The amount of trust placed in DockerHub to serve the correct images to everyone for uncritical download and execution is insane to me.

The whole industry does it, and it's the same as "curl | bash" to specify image:tag and not image@hash.

If I were TAO I'd apply for a job at Docker or their hosting provider.