I’d also say that anything that would cause a drift in your running container (assuming this is what you are meaning) would be better to prevent vs alerting for after the fact.