This is a basic requirement to secure containers. But static scanning is not enough, you need to run/sandbox the images before pushing them to registry. With the dearth of supply chain attacks you cannot trust the image (especially from 3rd party), most security teams will not know the impact of the container till it’s deployed.
