From 0d2cc6f667173f27cee4b39326b1934a01589ed0 Mon Sep 17 00:00:00 2001 From: Evan Vetere Date: Thu, 22 Oct 2026 00:31:58 -0400 Subject: [PATCH] fix: move images to Debian 13 base The production image is built on distroless base-debian12, whose CA bundle still trusts the compromised emSign ECC Root CA - G3. distroless base-debian13 ships 148 roots and drops G3, so the service stops trusting certificates chained to it. Key features/changes: - Build on golang:1.26-trixie and run on distroless base-debian13:nonroot, keeping the nonroot 65532:65532 user and glibc for race builds - Move the devcontainer to the go 1.26 trixie image, matching go.mod --- .devcontainer/devcontainer.json | 2 +- Dockerfile | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 8e5d88f..0131d80 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -1,6 +1,6 @@ { "name": "IPAM", - "image": "mcr.microsoft.com/devcontainers/go:1-1.24-bookworm", + "image": "mcr.microsoft.com/devcontainers/go:1.26-trixie", // docker-in-docker rather than a postgres service: internal/testdb starts its // own container, so the fixture resolves its backend identically here, on a diff --git a/Dockerfile b/Dockerfile index ffac6da..28c54ac 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # Build stage. Debian-based so the race detector (which requires CGO + glibc) # can be enabled via --build-arg RACE=-race. -FROM --platform=$BUILDPLATFORM golang:1.26-bookworm AS builder +FROM --platform=$BUILDPLATFORM golang:1.26-trixie AS builder # Build arguments for version injection ARG VERSION=dev @@ -57,7 +57,7 @@ RUN if [ -n "$RACE" ]; then \ # Runtime stage. distroless/base ships glibc so it works for both the default # CGO_ENABLED=0 static build and the CGO_ENABLED=1 race build. -FROM gcr.io/distroless/base-debian12:nonroot +FROM gcr.io/distroless/base-debian13:nonroot WORKDIR / COPY --from=builder /workspace/ipam .