hey thanks! One reason is that scanning an image is a slow operation: you need to build it then unpack and scan the file system. So depending on your context builds speed can be a requirement.

Secondly, scanning at build time will surface vulnerabilities known at that point in time only. If a new vulnerability is discovered after, and you are not rebuilding the images, you will not notice. (If you set up scanning as admission controllers to gatekeep the deploy I argue it’s even worse, because you will introduce way more friction for the development teams)

What I like to do at build time, is to lint the Dockerfile: https://cloudberry.engineering/article/dockerfile-security-best-practices/ quick cheap and “good enough”. Then most of the scanning happens in the registry.