Excuse my ignorance on docker, but why did the OP not use a proxy cache for the registry? [0]

If they were running this on a single machine with backups they could restore to a time before the incident.

Also querying and downloading from the public registry everytime time seems like a waste of bandwidth.

[0] https://blog.docker.com/2015/10/registry-proxy-cache-docker-...