Use non root numeric user for CAPA containers
@@ -47,8 +47,9 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
ENTRYPOINT [ "/start.sh", "/workspace/manager" ]
# Copy the controller-manager into a thin image
-FROM gcr.io/distroless/static:latest
+FROM gcr.io/distroless/static:nonroot
WORKDIR /
COPY --from=builder /workspace/manager .
-USER nobody
+# Use uid of nonroot user (65532) because kubernetes expects numeric user when applying pod security policies
+USER 65532
ENTRYPOINT ["/manager"]
