We read the image, we never run it

Scanning does not execute the container. CheckVibe pulls the image from the registry, unpacks the layers, and reads what is inside: which operating system packages are installed, at which versions, plus configuration and any files that should not be there.

Nothing is executed, so scanning cannot trigger the application, touch a database, or cost anything at runtime.