Making my builds more secure - Container vuln. scanning

Currently I am building apps and containers using docker-compose, with CI/CD going to Gitlea and Portainer to deploy via webhooks. Works well.

I am looking at ways to introduce code and container scanning for dangerous code and sec vulns in the containers or app libraries.

Spent the afternoon researching different methods, Harbour, Clair, Trivy, Syft etc.

What are you all using, what would you recommend?