feat: [#317] Update Docker base images to latest stable releases

[josecelano]

Overview

This PR implements issue #317: Update all Docker base images to the latest stable releases for improved security and consistency with the Torrust Tracker ecosystem.

Changes Made

1. Deployer Container Update

• Change: Updated docker/deployer/Dockerfile from rust:bookworm (Debian 12) to rust:trixie (Debian 13)
• Verification:
  • ✅ Docker image builds successfully
  • ✅ All 416 unit and integration tests pass
  • ✅ Trivy security scan: 1 HIGH (test artifact only), 0 CRITICAL
  • ✅ All linters pass

2. Security Improvements

• Deployer: Reduced from 25 HIGH + 7 CRITICAL (bookworm) to 1 HIGH + 0 CRITICAL (trixie) - 97% vulnerability reduction
• Backup: Verified using current debian:trixie-slim - stable with documented 7 HIGH vulnerabilities
• SSH Server: Verified using current alpine:3.23.3 - minimal Alpine base with 1 HIGH (test artifact)
• Provisioned Instance: Verified using current ubuntu:24.04 LTS - expected 11 HIGH for reference LTS OS

3. Documentation

Created comprehensive security scan reports with build and scan commands:

• Deployer Scan - Updated with trixie results
• Backup Scan - Updated with detailed vulnerability analysis
• SSH Server Scan - New, Alpine 3.23.3 minimal base
• Provisioned Instance Scan - New, Ubuntu 24.04 LTS reference
• Scans README - Updated with latest status and build/scan commands

4. Issue Specification

Updated Issue #317 Specification:

• Added build and scan commands for all images
• Linked to detailed scan reports
• Marked implementation as completed with acceptance criteria met

Alignment with Ecosystem

This update aligns with Torrust Tracker PR #1629, ensuring consistency across the Torrust ecosystem by using Debian 13 (trixie) as the stable base OS.

Testing & Verification

• Deployer Docker image builds successfully with trixie base
• All 416 unit and integration tests pass
• Trivy security scan completed for all images
• All linters pass (markdown, YAML, TOML, cspell, Clippy, rustfmt, shellcheck)
• Build from workspace root with correct context
• Pre-commit verification script passes

Build & Scan Commands

All Docker images can be built and scanned using the documented commands:

# Build all images
docker build --target release --tag torrust/tracker-deployer:local --file docker/deployer/Dockerfile .
docker build --tag torrust/tracker-backup:local docker/backup/
docker build --tag torrust/tracker-ssh-server:local docker/ssh-server/
docker build --tag torrust/tracker-provisioned-instance:local docker/provisioned-instance/

# Run security scans
trivy image --severity HIGH,CRITICAL torrust/tracker-deployer:local
trivy image --severity HIGH,CRITICAL torrust/tracker-backup:local
trivy image --severity HIGH,CRITICAL torrust/tracker-ssh-server:local
trivy image --severity HIGH,CRITICAL torrust/tracker-provisioned-instance:local

Commits

1. build: [#317] update deployer docker base image from rust:bookworm to rust:trixie - Core Dockerfile change
2. docs: [#317] mark deployer docker base image update as completed - Updated issue specification
3. docs: [#317] add comprehensive security scan reports for all docker images - Complete scan documentation

Related Issues

• Closes Update Docker base images to latest stable releases #317
• Related to Torrust Tracker PR #1629

[josecelano]

ACK 871ff43