Image scanning

Inventorying an image's operating system and language packages and matching them against known-vulnerability databases. It is cheap, automatable and genuinely effective at catching stale base images; it is also a well-known source of alert fatigue, because most findings are in components your code never calls. Scanning at build time and again in the registry matters, since a passing image acquires new findings over the following weeks without changing a byte.