What does a typical security gate look like in a Docker CI/CD pipeline?

Immediately after the build step (and before push to a registry or deployment trigger), run an image scanner like Trivy with a severity threshold (--severity CRITICAL,HIGH) and a non-zero exit code on matching findings, so the pipeline fails automatically rather than proceeding with a vulnerable image. This should be a blocking step, not an informational report, with a documented exception process for cases that genuinely can't be remediated immediately.