build: run one base across the whole stack (debian:trixie-slim)

[HuggeK]

Moves core, the updater sidecar and the optimizer onto one base —
debian:trixie-slim, current Debian stable (13). Findings and rationale: #730.
Version safeguard: #733.

Stacked on #728 — that branch is included here. Merge #728 first and this
diff reduces to the base change alone.

Why

Core was alpine:3.22, the updater was docker:27-cli (also alpine), and the
optimizer was python:3.12-slim-bookworm — two libcs, three unrelated base
images, three security streams. And bookworm is oldstable, so part of the
stack was already off full security support.

All three now sit on debian:trixie-slim. Verified, not assumed: the three
built images resolve to one identical base layer digest, so a host pulls that
rootfs once. Trixie also matches the Raspberry Pi OS release the SD image is
built from (deploy/pi-gen/config: RELEASE=trixie).

Beyond consistency the move buys glibc, so the image can run ordinary
prebuilt vendor binaries — the one thing musl genuinely blocks; a full
userland, so docker exec debugging on a live site stops fighting busybox;
and libnss-mdns wired into /etc/nsswitch.conf.

Being precise about what does and does not deliver mDNS

The FTW process does not get .local resolution from the base change. A
CGO_ENABLED=0 binary bypasses NSS entirely — net/conf.go:395-409 gates the
.local→libc path behind if canUseCgo {, false for every FTW build. That was
as true on glibc as it was on musl.

.local works because of #728, which resolves it in Go. The libnss-mdns here
makes .local resolvable for other glibc programs in the image (getent,
curl) and is what a future cgo build would use. It needs a mounted avahi
socket, documented in docs/operations.md. Full reasoning in #730.

Changes

• Dockerfile — alpine:3.22 → debian:trixie-slim; apk add → one
  apt-get layer with ca-certificates tzdata wget libnss-mdns.
• Dockerfile.updater — docker:27-cli → same base, with the docker CLI and
  compose plugin COPY --from=docker:27-cli. Same upstream artifact, explicitly
  pinned, and it keeps apt out of the emulated arm64 layer.
• Dockerfile.optimizer — python:3.12-slim-bookworm →
  python:3.12-slim-trixie. Bringing it along is what keeps the shared layer;
  leaving it behind would have split the pin.
• scripts/test-container-boundaries.sh — ^FROM alpine: asserted a proxy
  with no error message. Replaced with the invariant it stood for (core must not
  build on a Python base — that is how Python reached core originally), plus a
  new assertion that wget is present, both with real diagnostics.
• go/cmd/ftw/main.go — embed _ "time/tzdata". Production code reads
  time.Local, which silently degrades to UTC without zoneinfo, and the
  tzdata tests t.Skipf rather than fail, so that regression would ship green.
• scripts/install.sh, deploy/pi-gen/.../00-run.sh — both claimed uid 100
  came from an alpine adduser -S. No account has ever been created, on any
  base. Corrected.
• Docs + changeset (minor).

What I verified

All three images built and exercised, on both architectures where relevant:

Check	Result
One shared base layer across all three images	✅ identical digest f2ec4de8…
Optimizer: CVXPY actually solves on trixie	✅ cvxpy 1.9.2, highspy imports, Python 3.12.13, status optimal
Updater: copied CLI works	✅ docker 27.5.1, compose v2.33.0
Core: wget present and runnable	✅ /usr/bin/wget
CA bundle / zoneinfo	✅ both present
nsswitch.conf	✅ files mdns4_minimal [NOTFOUND=return] dns
Runs as uid 100 / gid 101	✅ amd64 and arm64
arm64 build under QEMU	✅ 79 s — the emulated-apt cost I expected to hurt does not
Boundary + compose gates	✅
CGO_ENABLED=0 cross-compiles	✅ linux/arm64, linux/amd64, windows/amd64

Size — less bad than the headline

Image	Before	After
core	53 MB	133 MB
updater	204 MB (docker:27-cli)	203 MB
optimizer	~830 MB	833 MB

The core image is the real cost. But docker:27-cli was never a small image, so
the updater move is size-neutral, and all three now share a 78.6 MB base
layer that is pulled once rather than three unrelated ones. At the deployment
level this is far closer to a wash than the core figure alone suggests — worth
weighing against firstboot.sh, which retries the first-boot pull forever at
60 s backoff.

Two things deliberately preserved

wget stays in the image permanently. ftw-updater docker execs it to
decide whether an update commits, and the updater never updates itself — it
only knows the core and optimizer components — so old sidecars persist in
the field indefinitely. Dropping wget would pin those hosts in an
update → rollback loop, and the call sites are stubbed in tests so CI would not
catch it. The boundary test now asserts wget for exactly this reason.

uid 100 / gid 101 stay numeric and unchanged. gid 101 is what grants access
to the optimizer's 0660 socket (worker.py:101); changing it degrades the
planner to the Go DP fallback silently. Verified neither has a passwd/group
entry on this base, so ownership renders numerically — cosmetic only, and
ENV HOME=/app/data continues to cover the missing entry.

The base is pinned to the codename, not stable-slim, so a major-version jump
cannot arrive silently on a rebuild. #733 adds the weekly check that tells us
when to move it deliberately.

🤖 Generated with Claude Code