When it comes to Docker, it is very convenient to use a third party container that already exist to do what we want. The problem is that those containers can be very complicated and have a large parent tree of other containers; they can even pull some code from repositories like GitHub. All of this is making a security audit harder.
I know it could sound naive, but could it be easy for someone to hide some malicious content in a container? I know that the answer is YES but I would like to know in which dimension, and if it's worth the risk. I'm a familiar with GitHub, and I usually take a look at the source-code when I use third party code (unless it's a well known project.)
I am wondering if the community is watching for those kinds of behavior because the harm of a malicious container could be bigger than malicious code.
How likely is a container to be malicious? (Considering it's a popular one.) As well, what dimensions could damage/use the other components of the underlining system or the others systems on the LAN ? To be even simpler, should I trust them?
Edit: I found an article from Docker that brings a bit of light in Docker security and best practices: Understanding Docker security and best practices .