Bump debian trixie base image

Dockerfile

@@ -5,16 +5,17 @@
 # Note: This is a PUBLIC image, it should not contain any sensitive data.
 #
 # Build targets:
-#   - slim: basic tools + security hardening (published as scalr/runner:<x.y.z>-slim)
-#   - full: slim + Python + cloud CLIs + hardening (published as scalr/runner:<x.y.z>
+#   - base: basic tools only (internal stage, not published)
+#   - slim: base + security hardening (published as scalr/runner:<x.y.z>-slim)
+#   - full: base + Python + cloud CLIs + hardening (published as scalr/runner:<x.y.z>
 #           and scalr/runner:<x.y.z>-python39)
 #
-# UBUNTU_BASE_IMAGE, UBUNTU_BASE_DIGEST and other ARGs are supplied at build
+# DEBIAN_BASE_IMAGE, DEBIAN_BASE_DIGEST and other ARGs are supplied at build
 # time via bake (see docker-bake.hcl + versions.json). The skip directive
 # above silences BuildKit's check for ARGs in FROM without a default.
 
-ARG UBUNTU_BASE_IMAGE
-ARG UBUNTU_BASE_DIGEST
+ARG DEBIAN_BASE_IMAGE
+ARG DEBIAN_BASE_DIGEST
 
 # Custom git-lfs build, we rely on Wolfi's approach from
 # https://github.com/wolfi-dev/os/blob/main/git-lfs.yaml
@@ -37,7 +38,7 @@ RUN <<EOT
     -o /out/git-lfs .
 EOT
 
-FROM ${UBUNTU_BASE_IMAGE}@${UBUNTU_BASE_DIGEST} AS base-slim
+FROM ${DEBIAN_BASE_IMAGE}@${DEBIAN_BASE_DIGEST} AS base
 
 ARG TARGETARCH
 
@@ -65,10 +66,13 @@ COPY --from=git-lfs-build /out/git-lfs /usr/bin/git-lfs
 
 # Non-root user available in every variant (optional; used when the container
 # runs with --user 1000). Created before hardening removes useradd.
-RUN <<EOT
-  userdel -r ubuntu
-  useradd -u 1000 -m scalr
-EOT
+RUN useradd -u 1000 -m scalr
+
+
+# ----------------------------------------------------------------------------
+# slim: base + security hardening (final image)
+# ----------------------------------------------------------------------------
+FROM base AS slim
 
 # Security hardening: strip privilege-escalation surface inherited from the base image.
 # Must run last so it cannot be undone by a later layer.
@@ -91,25 +95,15 @@ RUN <<EOT
     /bin/umount /usr/bin/umount
   # Strip SUID/SGID bits from every remaining file (defense-in-depth).
   find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -exec chmod a-s {} + 2>/dev/null || true
-  # Remove unnecesary files for final build
-  rm -rf \
-    /usr/bin/pebble
 EOT
 
-FROM scratch AS slim
-
-COPY --from=base-slim / /
-
 ENTRYPOINT ["/usr/bin/bash"]
 
+
 # ----------------------------------------------------------------------------
 # full: base + Python + cloud CLIs + hardening (final image)
 # ----------------------------------------------------------------------------
-FROM slim AS full
-
-SHELL ["/bin/bash", "-o", "pipefail", "-euxc"]
-
-ARG TARGETARCH
+FROM base AS full
 
 # Install python standalone build.
 ARG PYTHON_VERSION
@@ -277,5 +271,4 @@ RUN <<EOT
   find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -exec chmod a-s {} + 2>/dev/null || true
 EOT
 
-
 ENTRYPOINT ["/usr/bin/bash"]

README.md

@@ -67,10 +67,10 @@ versions below are the current pins (kept in sync with `versions.json` by
 * **Programming language**
   * Python ([v3.14.6](https://www.python.org/downloads/release/python-3146/)) — [standalone CPython build](https://github.com/astral-sh/python-build-standalone) from [astral.sh](https://astral.sh/)
 * **Cloud CLIs**
-  * AWS CLI ([2.35.13](https://github.com/aws/aws-cli/releases/tag/2.35.13)) — Amazon Web Services CLI
+  * AWS CLI ([2.35.22](https://github.com/aws/aws-cli/releases/tag/2.35.22)) — Amazon Web Services CLI
   * AWS Session Manager Plugin — SSM session support for the AWS CLI
-  * Azure CLI ([2.87.0](https://github.com/Azure/azure-cli/releases/tag/azure-cli-2.87.0)) — Microsoft Azure CLI
-  * Google Cloud SDK ([575.0.0](https://cloud.google.com/sdk/docs/release-notes#57500)) — `gcloud` with `alpha`, `beta`, and `gke-gcloud-auth-plugin` components
+  * Azure CLI ([2.88.0](https://github.com/Azure/azure-cli/releases/tag/azure-cli-2.88.0)) — Microsoft Azure CLI
+  * Google Cloud SDK ([575.0.1](https://cloud.google.com/sdk/docs/release-notes#57501)) — `gcloud` with `alpha`, `beta`, and `gke-gcloud-auth-plugin` components
   * Kubectl ([0.36.2](https://github.com/kubernetes/kubectl/releases/tag/v0.36.2)) — Kubernetes CLI
   * Scalr CLI ([0.18.0](https://github.com/Scalr/scalr-cli/releases/tag/v0.18.0)) — command-line client for the Scalr API
 

bump-versions.py

@@ -225,8 +225,8 @@ def _latest_python_version(series: str) -> tuple[str, str]:
     return "", ""
 
 
-def get_ubuntu_base_digest(image_ref: str) -> str:
-    """Resolve a Docker Hub image reference (e.g. "ubuntu:26.04") to
+def get_debian_base_digest(image_ref: str) -> str:
+    """Resolve a Docker Hub image reference (e.g. "debian:trixie-slim") to
     its current manifest digest. Uses Docker Hub's anonymous v2 registry API.
     """
     name, _, tag = image_ref.partition(":")
@@ -385,18 +385,18 @@ def main() -> int:
     base = read_versions(SECTION_BASE)
     changes: list[tuple[str, str, str]] = []
 
-    # UBUNTU_BASE_IMAGE is read-only here — the base image (e.g. ubuntu:26.04)
+    # DEBIAN_BASE_IMAGE is read-only here — the base image (e.g. debian:trixie-slim)
     # is a deliberate human choice and must not be auto-bumped. We only refresh the
     # digest pinning for whatever image is currently configured.
-    ubuntu_image = base.get("UBUNTU_BASE_IMAGE", "")
-    if not ubuntu_image:
-        log.error(f"UBUNTU_BASE_IMAGE missing from {VERSIONS_FILE} ({SECTION_BASE})")
+    debian_image = base.get("DEBIAN_BASE_IMAGE", "")
+    if not debian_image:
+        log.error(f"DEBIAN_BASE_IMAGE missing from {VERSIONS_FILE} ({SECTION_BASE})")
         return 1
     bump(
-        "ubuntu_base_digest",
-        "UBUNTU_BASE_DIGEST",
-        get_ubuntu_base_digest(ubuntu_image),
-        base.get("UBUNTU_BASE_DIGEST", ""),
+        "debian_base_digest",
+        "DEBIAN_BASE_DIGEST",
+        get_debian_base_digest(debian_image),
+        base.get("DEBIAN_BASE_DIGEST", ""),
         changes,
         section=SECTION_BASE,
     )

versions.json

@@ -2,22 +2,22 @@
   "variable": {
     "versions_base": {
       "default": {
-        "UBUNTU_BASE_IMAGE": "ubuntu:26.04",
-        "UBUNTU_BASE_DIGEST": "sha256:53958ec7b67c2c9355df922dd08dbf0360611f8c3cdb656875e81873db9ffdba"
+        "DEBIAN_BASE_IMAGE": "debian:trixie-slim",
+        "DEBIAN_BASE_DIGEST": "sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd"
       }
     },
     "versions_full": {
       "default": {
         "KUBECTL_VERSION": "v1.36.2",
         "KUBECTL_SHA256_AMD64": "1e9045ec32bea85da43de85f0065358529ea7c7a152eca78154fba5b58c27d82",
         "KUBECTL_SHA256_ARM64": "c957eb8c4bea27a3bb35b269edd9082e27f027f7b76b20b5bf4afebc726c6d3e",
-        "GCLOUD_VERSION": "575.0.0",
-        "GCLOUD_SHA256_AMD64": "92a7331b6b20c9869c5e234f15e44850a58af435ccab43578d4ede1ef368a6e6",
-        "GCLOUD_SHA256_ARM64": "54b607d35b7335297e5e4166b3f9137baa5b1a7c7d2f8ce396411e91bd1fd4df",
-        "AWS_CLI_VERSION": "2.35.13",
-        "AWS_CLI_SHA256_AMD64": "9d8358b854dfac0decde81a0a21471abb5fd52d7366533bf25affcbbc2d5ad90",
-        "AWS_CLI_SHA256_ARM64": "c562b596fa9711f340c82307ca9eff576a4b96e75f1a003d1e6b2fec77820883",
-        "AZURE_CLI_VERSION": "2.87.0",
+        "GCLOUD_VERSION": "575.0.1",
+        "GCLOUD_SHA256_AMD64": "7027aef2f0d72c147da6b2263cf77a4a4c659afe28aeca51a45134249997e2c3",
+        "GCLOUD_SHA256_ARM64": "1330c1303767dd15f56c50ff4ef5d6f0900ff46f139b46cfef72b93580102029",
+        "AWS_CLI_VERSION": "2.35.22",
+        "AWS_CLI_SHA256_AMD64": "edd9ba798acb3ef6131e5bf902d81999ebc8ad72fbec8771d690f3ed0c059110",
+        "AWS_CLI_SHA256_ARM64": "022e392e079ada523be29cdbb45061a74be6344179f8fddf2b8183f1898683f1",
+        "AZURE_CLI_VERSION": "2.88.0",
         "SCALR_CLI_VERSION": "0.18.0",
         "SCALR_CLI_SHA256_AMD64": "5321bcebd48d30f7c3a936a5c5f10d9d3cfb77ef2974575d4df8e7ee9f890589",
         "SCALR_CLI_SHA256_ARM64": "8dcada09b5bf10001f4e83190fc9c2a66df692beb07a74b4afe503d2fa75629e",