Any infosec and/or proxmox peeps out there?

[Daniel Stringfield]

I'm hoping to get a few questions answered here and maybe pick your brain offline.

Anyone have experience running Proxmox in a production environment?  Preferably in a modern DevOps and container based workflow?

Somewhat related I'm also curious what the preferred open source tool for scanning machine and container images is these days.  The shop I'm working in now has standardized on Ubuntu but our current OS/container scanning tool (trivy) has been flagging Ubuntu a lot.  Not sure if trivy just has a lot of false positives or Ubuntu LTS isn't getting updated frequently enough.   Is there a better scanning tool you'd recommend?  Is there a better container base image, and host image we may want to explore?

On Proxmox, we're also running into random things too numerous to mention here, but want to pick your brain on if you have been using this in production.