Best container security tools for about thirty self hosted images?

I run about thirty containers across a couple of small boxes at home and for a side project. I want something I can run myself that checks images for known vulnerabilities and obvious Dockerfile mistakes. A plain list of hundreds of CVEs does little for me on its own. Some sense of what to fix first would help a lot. SBOMs and config checks would be a bonus. Grype and Clair and Hadolint keep coming up in my searches. What are you running and how often do you rescan?