build(container): minimize build-stage images and reorganize CVE catalog

.github/skills/dev/maintenance/catalog-security-vulnerabilities/SKILL.md

@@ -23,27 +23,30 @@ provides a quick reference.
 ```text
 docs/security/analysis/
   README.md              ← Process + template
-  non-affecting/         ← CVEs that do NOT affect us (catalog)
+  production/            ← CVEs in the production runtime image (catalog)
+  build/                 ← CVEs in build-stage images (catalog)
   affecting/             ← CVEs that DO affect us (create when needed)
 ```
 
 ## Process (3 Steps)
 
 ### Step 1: Check the Catalog
 
-Before analyzing a new warning, check `docs/security/analysis/non-affecting/` to see if
-it has already been evaluated. Every file there documents why a set of CVEs is
-non-affecting. If found, the analysis is already done — link the existing document in
-any related issue or PR comment.
+Before analyzing a new warning, check `docs/security/analysis/production/` and
+`docs/security/analysis/build/` to see if it has already been evaluated. Every file there
+documents why a set of CVEs is non-affecting. If found, the analysis is already done —
+link the existing document in any related issue or PR comment.
 
 ### Step 2: Analyse and Document (if not cataloged)
 
 If the vulnerability is **not yet cataloged**:
 
 1. Determine whether it affects us (see criteria examples in the README).
-2. If **non-affecting**: create a dated file in `non-affecting/` following the template
-   in the README. Include rationale, future actions, and review cadence.
-3. If **affecting**: escalate immediately (see Step 3).
+2. Determine the impact context: production runtime (`production/`) or build stage
+   (`build/`).
+3. If **non-affecting**: create a dated file in the appropriate subdirectory following the
+   template in the README. Include rationale, future actions, and review cadence.
+4. If **affecting**: escalate immediately (see Step 3).
 
 ### Step 3: Escalate if Affecting
 

.github/skills/dev/maintenance/run-manual-docker-security-scan/SKILL.md

@@ -12,7 +12,8 @@ metadata:
       - docs/security/docker/scans/README.md
       - docs/security/docker/scans/torrust-tracker.md
       - docs/security/analysis/README.md
-      - docs/security/analysis/non-affecting/
+      - docs/security/analysis/production/
+      - docs/security/analysis/build/
 ---
 
 # Run Manual Docker Security Scan
@@ -26,7 +27,7 @@ Use this workflow to run and document manual security scans for the tracker prod
 - Documentation outputs:
   - `docs/security/docker/scans/torrust-tracker.md`
   - `docs/security/docker/scans/README.md`
-  - `docs/security/analysis/non-affecting/CVE-*.md` (when non-affecting CVEs are analyzed)
+  - `docs/security/analysis/production/CVE-*.md` (when non-affecting CVEs are analyzed)
 
 ## Quick Commands
 
@@ -48,7 +49,7 @@ trivy image --severity MEDIUM,HIGH,CRITICAL torrust-tracker:local
 Before analyzing any CVE, search the existing catalog:
 
 ```bash
-grep -R "CVE-<id>" docs/security/analysis/non-affecting/
+grep -R "CVE-<id>" docs/security/analysis/
 ```
 
 If already present and `requires-recheck-when` conditions have not changed, reuse the existing verdict.
@@ -70,7 +71,8 @@ Update:
 
 ### Step 4: Document New Non-Affecting CVEs
 
-For any new non-affecting CVE, create `docs/security/analysis/non-affecting/CVE-<id>.md` with:
+For any new non-affecting CVE, create `docs/security/analysis/production/CVE-<id>.md` or
+`docs/security/analysis/build/CVE-<id>.md` with:
 
 - frontmatter fields:
   - `cve-id`

Containerfile

@@ -3,10 +3,14 @@
 # Torrust Tracker
 
 ## Builder Image
-FROM docker.io/library/rust:trixie AS chef
+FROM docker.io/library/rust:slim-trixie AS chef
 WORKDIR /tmp
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends curl libssl-dev pkg-config \
+ && apt-get clean \
+ && rm -rf /var/lib/apt/lists/*
 RUN curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
-RUN cargo binstall --no-confirm --locked torrust-cargo-chef@0.1.78 cargo-nextest
+RUN cargo binstall --no-confirm --locked torrust-cargo-chef@0.1.78 cargo-nextest@0.9.140
 # Note: We use the `torrust-cargo-chef` fork (v0.1.78) while upstream PR
 # https://github.com/LukeMathWalker/cargo-chef/pull/360 is pending. Once merged,
 # switch back to upstream `cargo-chef` and remove this comment.
@@ -16,10 +20,12 @@ FROM docker.io/library/rust:slim-trixie AS tester
 WORKDIR /tmp
 
 RUN apt-get update \
- && apt-get install -y curl sqlite3 time \
- && apt-get autoclean
-RUN curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
-RUN cargo binstall --no-confirm --locked cargo-nextest
+ && apt-get install -y --no-install-recommends curl sqlite3 time \
+ && curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash \
+ && cargo binstall --no-confirm --locked cargo-nextest@0.9.140 \
+ && apt-get purge -y --auto-remove curl \
+ && apt-get clean \
+ && rm -rf /var/lib/apt/lists/*
 # Database initialization: Tests at runtime require a pre-initialized SQLite3 database
 # to test against a valid (not corrupted) schema. The VACUUM command optimizes the
 # database file layout. This image layer is inherited by test_debug and test stages.
@@ -29,7 +35,11 @@ RUN time mkdir -p /app/share/torrust/default/database/ \
  && time sqlite3 /app/share/torrust/default/database/tracker.sqlite3.db "VACUUM;"
 
 ## Su Exe Compile
-FROM docker.io/library/gcc:trixie AS gcc
+FROM docker.io/library/debian:trixie-slim AS gcc
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends gcc libc6-dev \
+ && apt-get clean \
+ && rm -rf /var/lib/apt/lists/*
 COPY ./contrib/dev-tools/su-exec/ /usr/local/src/su-exec/
 RUN cc -Wall -Werror -g /usr/local/src/su-exec/su-exec.c -o /usr/local/bin/su-exec \
  && chmod +x /usr/local/bin/su-exec