From 076008ea204fea5571f4812b73048581d1125a3c Mon Sep 17 00:00:00 2001 From: Alexander Tarasov Date: Thu, 8 Oct 2026 14:28:38 +0200 Subject: [PATCH] build(docker): Use Debian 13 (trixie) for the build and runtime images Move the runtime image from debian:bookworm-slim to debian:trixie-slim, and the build image from the mirrored rust:1.96.1-bookworm to the mirrored rust:1.96.1-trixie so the binary links against the same OpenSSL and glibc it runs with. This drops four of the five critical CVEs in the image and puts it on the same Debian release as the distroless image that comes next. Co-Authored-By: Claude Opus 5.5 --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index f220a7c7..270211c8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ # Build image # Note that it is important which debian image is used, because not all of them have a # recent enough version of protobuf-compiler -FROM ghcr.io/getsentry/image-mirror-library-rust:1.96.1-bookworm AS build +FROM ghcr.io/getsentry/image-mirror-library-rust:1.96.1-trixie AS build RUN apt-get update && apt-get upgrade -y RUN apt-get install -y cmake pkg-config libssl-dev librdkafka-dev protobuf-compiler @@ -34,7 +34,7 @@ RUN cargo build --release RUN echo "${TASKBROKER_VERSION}" > ./VERSION # Runtime image -FROM debian:bookworm-slim +FROM debian:trixie-slim RUN groupadd taskbroker --gid 1000 && useradd --gid taskbroker --uid 1000 taskbroker