How should image vulnerability scanning be designed for production in Container Security?

Scan in CI and registries, define severity and exploitability policy, track exceptions, and rebuild images when bases are patched.