You push a new container image Thursday afternoon. Tests pass, the PR is approved, the pipeline goes green. You close your laptop feeling good about the week.

Friday morning, a Slack message from the security team is waiting: the release is blocked. There’s a critical CVE in a base image you …

Your pipeline is green. The Docker build finished in ninety seconds, docker push sent the new tag to your registry without a hiccup, and the deployment rolled out before your coffee got cold. Three weeks later, a message lands in the security channel: acme/api:2.4.1 has 45 known vulnerabilities, …