Container image security

- Base image vulnerabilities (Trivy, Grype, Clair, Snyk) - Secrets in images (git history, env vars, layers) - Signed images and supply chain (Cosign, Notary, Sigstore) - Image registry access controls