Platform security engineers and DevSecOps practitioners need to audit container image supply chains — base image provenance, dependency vulnerability chains, SBOM completeness, and signing policy compliance — before images are promoted to production registries. Supply chain attacks on container images are increasing in frequency and severity.