I worked on a code signing library years ago that fed data to safety critical systems. Other than the one coworker who suggested we add a sign-off step where we manually verified the SHA-1 hashes (which caught that we had recompiled one of the libraries ourselves, oops!) I had to defend my decision to check all of the dependencies into version control and manually update them.
This class of problems has been around for ages, the noise is just getting louder every day.
It’d be a great strategy for Docker, considering what looks like an industry convergence on K8S as an orchestration platform.
Double down on the Dockerfile format and abstract things that would otherwise be frozen in time, taking ownership of some aspects of DockerHub that are currently managed by contributors. They do this already with official language images but there has to be more to it outside of that than expecting people to figure out the intimate details of each base image while keeping them up to date across OS versions and library versions.
I think they are doing something along those lines with linuxkit: https://github.com/linuxkit/linuxkit.
It's thankfully a very interesting problem to have to address, but it does mean that our time-to-market is inherently atypical compared to others.