Comment by lolinder

I like Podman's solution: all images must be fully qualified, with even Docker Hub images requiring a docker.io/ prefix.