Not by default. Anyone can publish an image, so safety depends on who made it and how you check it. Prefer images with Docker's official, verified publisher or sponsored open source badges, pin the digest, scan before use, and avoid running as root.
What the badges mean
Docker's documentation describes three kinds of trusted content. Docker Official Images are a curated set of repositories that Docker recommends for most projects, such as base operating systems and language runtimes, and they are documented and regularly updated. Verified Publisher images come from commercial publishers that Docker has verified. Docker-Sponsored Open Source images come from open source projects that Docker sponsors and has verified as trusted and maintained.
A badge says something about the publisher. It does not say the image has no vulnerabilities.
A checklist before you pull
- Is the name exactly right? Lookalike names are common.
- Does it carry one of the trust badges, or does the publisher link to the source repository?
- When was it last updated?
- Is there a Dockerfile or build source you can read?
- Does the image run as a non-root user?
Pin by digest
A tag such as latest can point to different content tomorrow. A digest names exact content. Pin the digest in your build files and update it on purpose, with a scan, not by accident.
Scan it
Run a vulnerability scan on the image you plan to use, and look at secrets or odd files too. An image from a good publisher still carries whatever its base and packages carry on the day it was built.
Limit what it can do
Run containers with the fewest privileges that work. Drop capabilities, use a read only filesystem where possible, and avoid mounting sensitive host paths. If an image misbehaves, these limits contain the damage.
When the answer is no
An image with no source, no update history, an unknown publisher and a request for broad privileges should not run anywhere that matters. Build your own from an official base instead.
Quick check
Does an official badge mean zero vulnerabilities?
No. It describes the publisher and upkeep, not the findings in a given build. Scan it.
Why pin an image by digest?
A digest identifies exact content, so you know what you tested is what you run.
Sources
Last reviewed: 19 October 2026.
