From 23cb7f8e45c24c3fb708226c54ca40dcab5a0c7c Mon Sep 17 00:00:00 2001
From: Luca Muscariello <muscariello@ieee.org>
Date: Thu, 12 Feb 2026 12:22:55 +0100
Subject: [PATCH] fix(build): upgrade zot runtime base image to distroless
 debian13 (#3791)

* fix(build): upgrade zot runtime base image to distroless debian13

Signed-off-by: Luca Muscariello <muscariello@ieee.org>

* fix(build): align Makefile BASE_IMAGE with distroless debian13

Signed-off-by: Luca Muscariello <muscariello@ieee.org>

---------

Signed-off-by: Luca Muscariello <muscariello@ieee.org>
---
 .github/workflows/publish.yaml | 2 +-
 Makefile                       | 2 +-
 build/Dockerfile               | 2 +-
 build/Dockerfile-conformance   | 2 +-
 build/Dockerfile-minimal       | 2 +-
 build/Dockerfile-zxp           | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 65eba8d3..93d024fd 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -24,7 +24,7 @@ jobs:
             echo "BASE_IMAGE=freebsd/freebsd-static:14.3" >> "$GITHUB_ENV"
           else
             ARCH=${{ matrix.arch }}
-            echo "BASE_IMAGE=gcr.io/distroless/base-debian12:latest-${ARCH}" >> "$GITHUB_ENV"
+            echo "BASE_IMAGE=gcr.io/distroless/base-nossl-debian13:latest-${ARCH}" >> "$GITHUB_ENV"
           fi
       - name: Check out the repo
         uses: actions/checkout@v6
diff --git a/Makefile b/Makefile
index 8b1d8386..4f0a41e6 100644
--- a/Makefile
+++ b/Makefile
@@ -72,7 +72,7 @@ UI_DEPENDENCIES := search,mgmt,userprefs
 # freebsd is not supported for pie builds if CGO is disabled
 # see supported platforms at https://cs.opensource.google/go/go/+/master:src/internal/platform/supported.go;l=222-231;drc=d7fcb5cf80953f1d63246f1ae9defa60c5ce2d76
 BUILDMODE_FLAGS := -buildmode=pie
-BASE_IMAGE=gcr.io/distroless/base-debian12:latest-$(ARCH)
+BASE_IMAGE=gcr.io/distroless/base-nossl-debian13:latest-$(ARCH)
 ifeq ($(OS),freebsd)
 	BUILDMODE_FLAGS=
 	BASE_IMAGE=freebsd/freebsd-static:14.3
diff --git a/build/Dockerfile b/build/Dockerfile
index 04b1f501..e5e2d803 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -6,7 +6,7 @@
 #   FROM argument 'BASE_IMAGE' is not declared
 # Podman: Error: determining starting point for build: no FROM statement found
 # ---
-ARG BASE_IMAGE
+ARG BASE_IMAGE=gcr.io/distroless/base-nossl-debian13:latest
 
 # ---
 # Stage 1: Install certs, build binary, create default config file
diff --git a/build/Dockerfile-conformance b/build/Dockerfile-conformance
index 5862d1b4..9ef9268a 100644
--- a/build/Dockerfile-conformance
+++ b/build/Dockerfile-conformance
@@ -6,7 +6,7 @@
 #   FROM argument 'BASE_IMAGE' is not declared
 # Podman: Error: determining starting point for build: no FROM statement found
 # ---
-ARG BASE_IMAGE
+ARG BASE_IMAGE=gcr.io/distroless/base-nossl-debian13:latest
 
 # ---
 # Stage 1: Install certs, build binary, create default config file
diff --git a/build/Dockerfile-minimal b/build/Dockerfile-minimal
index 1705e146..98d518de 100644
--- a/build/Dockerfile-minimal
+++ b/build/Dockerfile-minimal
@@ -6,7 +6,7 @@
 #   FROM argument 'BASE_IMAGE' is not declared
 # Podman: Error: determining starting point for build: no FROM statement found
 # ---
-ARG BASE_IMAGE
+ARG BASE_IMAGE=gcr.io/distroless/base-nossl-debian13:latest
 
 # ---
 # Stage 1: Install certs, build binary, create default config file
diff --git a/build/Dockerfile-zxp b/build/Dockerfile-zxp
index df83ed6b..8957e3d6 100644
--- a/build/Dockerfile-zxp
+++ b/build/Dockerfile-zxp
@@ -6,7 +6,7 @@
 #   FROM argument 'BASE_IMAGE' is not declared
 # Podman: Error: determining starting point for build: no FROM statement found
 # ---
-ARG BASE_IMAGE
+ARG BASE_IMAGE=gcr.io/distroless/base-nossl-debian13:latest
 
 # ---
 # Stage 1: Build binary, create default config file