Three repository modes — scanning stops at the virtual layer.
Standard stores your own artifacts, remote proxies a public registry, virtual unifies both behind one URL.
Standard
meridian-images — your own pushed builds.
Remote
Proxies + caches Docker Hub — scannable.
Virtual
Unifies both behind one URL — NOT scanned itself.
Real trap: Artifact Analysis does not scan inside a virtual repository. If a pipeline pulls exclusively through one virtual URL, confirm the underlying standard/remote repos it unifies are scanned individually.