[lolinder]

> They are the exact equivalent of shipping a developer's laptop off to the datacenter and replicating it as a production image.

If you're building your containers on a developer laptop and then pushing them to the registry from there, yes.

You can also not do that and instead have all builds happen on a CI server that isn't ever touched directly by anyone, like you should really be doing to build any artifact that gets deployed to production, container or otherwise.

[dsr_]

Read the proviso again, please: this is a criticism of receiving containers from an outside source, not using them to distribute your own images.

[lolinder]

The proviso could have been read either way, and your claim that it's an exact equivalent of shipping off a developer laptop makes no sense if what you meant was "you're downloading untrusted code from strangers". I read it first the way you apparently meant it but chose to respond to the meaning that made your second sentence make sense rather than the one that made it a non sequitur.

Using images from untrusted sources is a not-quite-exact equivalent of downloading code directly from npm and shipping it off to production.