feat: Build Debian images based on Trixie instead of Bookwork

[andreped]

Describe the Problem

As published by Debian:
https://www.debian.org/News/2025/20250809

Trixie (Debian 13) is out, and it would be great to start building and testing dotnet applications on Trixie.

Trixie has much less vulnerabilities than Bookwork. As low as zero high or critical vulnerabilities.

Here is a simple report that I created using Trixie:

debian:trixie-slim (debian 13.0)
Total: 50 (UNKNOWN: 0, LOW: 50, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

It would therefore be created if there were offered dotnet docker images based on Trixie! :]

[richlander]

We decided to switch to Ubuntu as our default container OS for .NET 10. As Trixie came closer, we decided that we could encourage users to move to .NET 8 + Noble or .NET 10 + Noble. We're just going to "run out the clock" on .NET 8 + Bookworm.

Debian has been an amazing container OS for us. We originally had only Debian and then added Alpine and then Ubuntu. More recently, we realized that our users were better served by Ubuntu (due to longer lifecycle). That means that the case for maintaining Debian images has become weaker for us. However, we still think Debian is a very solid OS and amazing OSS project.

Related:

• Proposal: Switch to Ubuntu for .NET convenience tags #5709
• Platforms for .NET 10 container images #6539

[andreped]

@richlander Thanks for the quick response! :]

I completely understand that maintaining several OS is a challenge. I understand the choice of Ubuntu as well, but I find it unfortunate, as both Ubuntu and Debian 12 tend to have more vulnerabilities than Alpine (and not Debian 13 - Trixie). The latter two I would think are better for production use. But again, I understand the reasoning.

But I see that you are referring to .NET 8.0 and 10.0. What about 9.0?
Did this project ever build a .NET 9.0 image based on Trixie, that is readily available on Docker Hub or similar?

[MichaelSimons]

but I find it unfortunate, as both Ubuntu and Debian 12 tend to have more vulnerabilities than Alpine

Have you considered the .NET Ubuntu Chiseled images?

[andreped]

but I find it unfortunate, as both Ubuntu and Debian 12 tend to have more vulnerabilities than Alpine

Have you considered the .NET Ubuntu Chiseled images?

No, i was not aware of this distroless alternative. Did a quick test pulling and running image scan on the image, and this looks very promising. I will try to migrate to this image, and report if I get this working. Thanks for the input, @MichaelSimons! :]

[andreped]

🚀 Update: I managed to get it completely working with our custom speech-to-text application. So I am sharing some of my findings, for anyone who might get stuck on this issue.

Three hurdles I met when moving from old debian-based dotnet image:

• Getting custom certificates to work in .NET Ubuntu Chiseled image was not straight forward.
• Make sure you set ENV ASPNETCORE_URLS=http://*:<PORT> in final image to allow communication with it.
• Azure AI Speech SDK required dependencies that needed to be copied to the final image (like libasound.so).

I resolved these through a multi-stage build. This was resolved by copying in what we needed from builder stages into the final image. Certificates can likely best be handled through volume mounting, but I preferred a solution more similar to what we already had.

Here are some useful resources:

• https://github.com/dotnet/dotnet-docker/blob/main/samples/dotnetapp/Dockerfile.chiseled
• Provide guidance for using update-ca-certificates in distroless images #5045

[richlander]

ASPNETCORE_URLS should not be needed. That's doing the same thing as ASPNETCORE_HTTP_PORTS=8080 (which can be overridden). There is also an HTTPS variant. The value of ASPNETCORE_URLS is that you can set HTTP and HTTPS in a single ENV, while the value of the PORTS variant is being able to pass integers with no fancy syntax.

dotnet-docker/src/runtime-deps/8.0/noble-chiseled/amd64/Dockerfile

Line 48 in 0d42f59

ASPNETCORE_HTTP_PORTS=8080 \