Run your own artifactory, have that as your docker repository too, only allow the use of jars that have been vetted ... it's what we do where I work, it's not hard, and it solves 99% of these gripes.