"The images from GCR or Distroless, I understand that you can add a tag ':nonroot', but how do I know which ID they have defined in those base images?"
The question is because I am using Trivy to detect if an image is root or nonroot, and it seems that Trivy does not support the Distroless tag. As a result, it generates a report with a HIGH risk for potentially having a root image.
To solve the problem and be able to learn something new.