[reilly3000]

That's definitely true, but given the sensitivity of having access to private source and secrets I think its fair to call out a warning.

[ericlewis]

couldn't a malicious docker image also be tooled to dump all of that stuff to an external destination?

[reilly3000]

Absolutely. CI systems tend to get broad access to everything sacred. Giving that level of access to community code is risky in the least.