Your organization deploys applications as Docker containers and you want to detect known vulnerabilities in the Docker images used for provisioning. You need to integrate image scanning into the application lifecycle and surface vulnerabilities as early as possible. What should you configure?

The correct approach is to integrate image scanning early and continuously. A task in the continuous integration (CI) pipeline scans images as they are built, catching vulnerabilities before deployment. This "shift-left" strategy is crucial for early detection. Additionally, a scheduled task that analyzes the image registry ensures that images already built and stored are re-scanned periodically. This addresses new vulnerabilities discovered after an image was initially built, even if it hasn't been re-built. Manual tasks are inefficient and prone to human error. Scanning only during continuous deployment (CD) or against running production containers misses the opportunity for early detection and remediation, making it more costly and riskier to fix issues. Scanning only the production container also doesn't address vulnerabilities in the image itself, only the running instance.