I need to find a tool that could cover the needs of my team. More sooner than later we will be allowing developer to push their own docker base images to registry and need to find a tool that inspect those images and scan, approve/reject and generate reports of those images.
Our registry is Artifactory and it will continue to be but it has some gaps. I also study xray but as far as I know there are some things that will be really needed that seems jfrog doesn't provide.
I need a way to whitelist registries and images and I need to be able to apply rules to not used images in X period, like delete them or generate reports for manual intervention. Both of those seems not covered by Artifactory-xray.
What it seems covered is, vulnerability scan and license scan which is not enough.
Any recomendation will be apreciated.