Reapply Debian base image upgrade from bookworm to trixie

Stan Hurequested to merge
sh-reapply-debian-trixie into master

What does this MR do?

Reapplies the Debian base image upgrade from debian:bookworm-slim to debian:trixie-slim, restoring the change originally merged in !3032 (merged) and reverted in !3046 (merged).

This is a "revert of the revert" of !3046 (merged) — the diff is byte-for-byte the change that was already reviewed and merged in !3032 (merged).

Why it was reverted, and why it is safe now

!3032 (merged) was reverted (!3046 (merged)) due to incident INC-13276. Root cause: GitLab's CNG upstream trigger (scripts/trigger-build.rb) hardcoded DEBIAN_IMAGE=debian:bookworm-slim in the trigger's extra_variables. A trigger variable outranks the value in CNG's ci_files/variables.yml, so on stable pipelines the hardcoded bookworm won and a bookworm base was built against trixie Dockerfiles, producing broken images.

That override was removed in gitlab-org/gitlab!250771 (merged) (merged), which stops sending DEBIAN_IMAGE/ALPINE_IMAGE from the trigger and makes CNG's ci_files/variables.yml the single source of truth. With that in place the upgrade is safe to reapply.

What is included

The full trixie change set from !3032 (merged):

  • Base image debian:bookworm-slim → debian:trixie-slim across all Dockerfiles and ci_files/variables.yml
  • t64 package renames: libicu72→libicu76, libpng16-16→libpng16-16t64, libcurl3-gnutls→libcurl3t64-gnutls, libssl3→libssl3t64
  • distroless base-debian12 → base-debian13 (gitlab-kas, gitlab-agentk)
  • postgresql: add libicu-dev (PG18 enables ICU by default; trixie no longer pulls it in transitively)
  • gitlab-base: install adduser (removed from the trixie base image)
  • gitlab-rails: install tzdata-legacy (legacy timezone names moved out of tzdata; needed for cron parsing)
  • gitlab-shell: install systemd-standalone-sysusers so openssh-server does not pull in full systemd (~20 MiB)

Related

Merge request reports