Update Docker base images to latest stable releases

[josecelano]

Overview

Update all Docker base images to the latest stable releases to ensure security, stability, and consistency across the Torrust Tracker Deployer environment. This is a periodic maintenance task to keep the application secure and aligned with current best practices for container base image selection.

This task was motivated by the Torrust Tracker project's recent update to use trixie as the stable Debian version (see PR #1629), ensuring consistency across the ecosystem.

Current State

Base Images in Use

1. docker/backup/Dockerfile

   • Current: debian:trixie-slim ✅ (Already updated)

2. docker/deployer/Dockerfile

   • Current: rust:bookworm → Needs: Update to rust:trixie

3. docker/provisioned-instance/Dockerfile

   • Current: ubuntu:24.04 (LTS) → Verify current status

4. docker/ssh-server/Dockerfile

   • Current: alpine:3.23.3 → Check for newer releases

Implementation Plan

Phase 1: Review and Plan (Security Scanning)

For each Docker image:

• Check latest release availability
• Run Trivy security scan (before and after)
• Document findings

Phase 2: Update Dockerfiles

• Update docker/deployer/Dockerfile: rust:bookworm → rust:trixie
• Update docker/provisioned-instance/Dockerfile: Verify/update Ubuntu
• Update docker/ssh-server/Dockerfile: Verify/update Alpine
• Verify docker/backup/Dockerfile: Already on trixie-slim ✅

Phase 3: Security Scanning

For each updated image:

• Build image locally
• Run Trivy scan: trivy image --severity HIGH,CRITICAL {image}
• Compare to baseline
• Document results in docs/security/docker/scans/

Phase 4: Testing

• Run pre-commit checks: ./scripts/pre-commit.sh
• Build all Dockerfiles
• Verify tests pass
• No regressions in dependent services

Phase 5: Documentation and Commit

• Update security scan documentation
• Commit changes
• Create draft PR for team review

Acceptance Criteria

Quality Checks:

• Pre-commit checks pass: ./scripts/pre-commit.sh

Base Image Updates:

• All Dockerfiles reviewed for outdated base images
• docker/deployer/Dockerfile: Updated to rust:trixie
• docker/provisioned-instance/Dockerfile: Verified/updated
• docker/ssh-server/Dockerfile: Verified/updated
• docker/backup/Dockerfile: Verified on trixie-slim

Security Scanning:

• Trivy scan run for each updated image
• Results documented in docs/security/docker/scans/
• HIGH/CRITICAL vulnerabilities reviewed

Testing:

• All Docker images build successfully
• Unit and integration tests pass
• E2E workflow tests pass

Related Documentation

• Docker Security Scanning Guide
• Security Scan Results
• Specification: docs/issues/update-docker-base-images.md
• Torrust Tracker PR #1629
• Issue #250: Automated security scanning workflow

Labels: maintenance, docker, security, devops