Q: You need to enforce that every Docker image pushed to your internal container registry has been scanned for CVEs and has zero Critical severity vulnerabilities. How do you implement this as a hard gate in the CI pipeline and in the registry itself?

CI pipeline gate:

• ECR: Enable Enhanced Scanning (powered by Inspector). Set a lifecycle policy to deny pull of images tagged :latest that have Critical findings.
• Harbor: Enable the Interrogation Service with Trivy. Set a project-level rule: "Prevent vulnerable images from running" at Critical threshold. Images failing the gate cannot be pulled by Kubernetes — the imagePullPolicy fails, preventing deployment.

--exit-code 1 makes the job fail if any unfixed Critical CVEs are found. --ignore-unfixed skips CVEs where no upstream patch yet exists (reduces noise). Registry-level enforcement: Configure the registry (ECR, Harbor, or Artifactory) to enforce a scan policy:

- name: Scan image for CVEs
  run: |
    trivy image --exit-code 1 --severity CRITICAL \
      --ignore-unfixed \
      ${{ env.IMAGE_TAG }}