I'm sticking with my "look at the images in the registry for vuln scans", "query the cluster for currently running images" approach