Distroless images blind your vulnerability scanners: bottom-up containers restore the visibility
On October 19, 2026, a CNCF post detailed the distroless paradox: stripping out the shell and package manager also erases the metadata scanners need, producing false negatives. If your minimal image cannot be audited by Trivy, rebuild it from the bottom up to keep the metadata without reintroducing the bloat.