Debian 13

.github/workflows/docker.yaml

@@ -45,7 +45,7 @@ jobs:
       matrix:
         os:
           - name: debian
-            version: 12
+            version: 13
           - name: ubuntu
             version: 24.04
 

.github/workflows/release.yaml

@@ -33,9 +33,9 @@ jobs:
               "ubuntu/24.04",
               "capms-ubuntu/1.32.9",
               "firewall/3.0-ubuntu",
-              "debian/12",
-              "debian-nvidia/12",
-              "almalinux/9"
+              "debian/13",
+              "debian-nvidia/13",
+              "almalinux/9",
             ]
 
       - name: Update release body

Makefile

@@ -50,14 +50,14 @@ test:
 
 .PHONY: debian
 debian: test binary
-	mkdir -p "images/debian/12"
-	OS_NAME=debian OUTPUT_FOLDER="" SEMVER_MAJOR_MINOR=12 docker buildx bake --no-cache debian
-	OS_NAME=debian OUTPUT_FOLDER="" CIS_VERSION=v4.1-4 SEMVER_MAJOR_MINOR=12 ./test.sh
+	mkdir -p "images/debian/13"
+	OS_NAME=debian OUTPUT_FOLDER="" SEMVER_MAJOR_MINOR=13 docker buildx bake --no-cache debian
+	OS_NAME=debian OUTPUT_FOLDER="" CIS_VERSION=v4.1-4 SEMVER_MAJOR_MINOR=13 ./test.sh
 
 .PHONY: nvidia
 nvidia:
-	mkdir -p "images/nvidia/12"
-	OS_NAME=nvidia OUTPUT_FOLDER="" SEMVER_MAJOR_MINOR=12 docker buildx bake --no-cache debian-nvidia
+	mkdir -p "images/nvidia/13"
+	OS_NAME=nvidia OUTPUT_FOLDER="" SEMVER_MAJOR_MINOR=13 docker buildx bake --no-cache debian-nvidia
 
 .PHONY: ubuntu
 ubuntu: test binary

cmd/tools/handle-release/main_test.go

@@ -12,7 +12,7 @@ import (
 	"time"
 
 	"cloud.google.com/go/storage"
-	"github.com/docker/docker/api/types/container"
+	"github.com/moby/moby/api/types/container"
 	"github.com/stretchr/testify/require"
 	"github.com/testcontainers/testcontainers-go"
 	tlog "github.com/testcontainers/testcontainers-go/log"

debian-nvidia/Dockerfile

@@ -1,5 +1,6 @@
 FROM baseapp
 
+ARG KERNEL_VERSION
 ENV DEBCONF_NONINTERACTIVE_SEEN="true" \
     DEBIAN_FRONTEND="noninteractive"
 
@@ -8,15 +9,11 @@ COPY --from=ctx . /
 RUN set -ex \
  && rm -f /.dockerenv \
  && apt-get update \
- && apt-get remove --yes linux-image-*-amd64 \
- && apt-get install --yes -t bookworm-backports \
-    linux-image-amd64 \
-    linux-headers-amd64 \
+ && apt-get install --yes \
+    linux-headers-${KERNEL_VERSION}-amd64 \
     dkms \
-    software-properties-common \
- && curl -fsSL https://developer.download.nvidia.com/compute/cuda/repos/debian12/x86_64/cuda-keyring_1.1-1_all.deb -o cuda-keyring_1.1-1_all.deb \
+ && curl -fsSL https://developer.download.nvidia.com/compute/cuda/repos/debian13/x86_64/cuda-keyring_1.1-1_all.deb -o cuda-keyring_1.1-1_all.deb \
  && dpkg -i cuda-keyring_1.1-1_all.deb \
- && add-apt-repository contrib \
  && apt-get update \
  && apt-get install --yes \
     nvidia-open

debian/Dockerfile

@@ -1,5 +1,5 @@
 ARG BASE_OS_NAME=debian
-ARG BASE_OS_VERSION=bookworm
+ARG BASE_OS_VERSION=trixie
 
 FROM golang:1.22-bookworm AS ignition-builder
 ARG IGNITION_BRANCH
@@ -48,10 +48,10 @@ RUN set -ex \
     apt-utils \
     ca-certificates \
     cloud-init \
-    cpufrequtils \
     curl \
     cryptsetup \
     dbus \
+    e2fsprogs \
     efibootmgr \
     ethtool \
     gettext-base \
@@ -90,8 +90,11 @@ RUN set -ex \
  && userdel -f ubuntu || true \
  && curl -fLsS https://github.com/metal-stack/go-lldpd/releases/download/${GOLLDPD_VERSION}/go-lldpd.tgz -o /tmp/go-lldpd.tgz \
  && tar -xf /tmp/go-lldpd.tgz \
- && curl -fLsS ${DOCKER_URL}/linux/${DOCKER_APT_OS}/gpg | apt-key add - \
- && echo "deb [arch=amd64] ${DOCKER_URL}/linux/${DOCKER_APT_OS} ${DOCKER_APT_CHANNEL} stable" > /etc/apt/sources.list.d/docker.list \
+ && curl -fLsS ${DOCKER_URL}/linux/${DOCKER_APT_OS}/gpg -o /etc/apt/keyrings/docker.asc \
+ && chmod a+r /etc/apt/keyrings/docker.asc \
+ && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/$(. /etc/os-release && echo "$ID") \
+    $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
+    sudo tee /etc/apt/sources.list.d/docker.list > /dev/null \
  && apt-get update \
  && apt-get install --yes --no-install-recommends containerd.io=${CONTAINERD_VERSION} \
  # generate a default containerd config because the one coming with the package prevents GNA to create a proper config for cgroup v2

debian/context/kernel-installation.sh

@@ -16,17 +16,18 @@ if [ "${ID}" = "ubuntu" ] ; then
     apt-get install --yes \
         /tmp/linux-image* \
         /tmp/linux-modules* \
+        cpufrequtils \
         intel-microcode
 else
     echo "Debian - Install kernel"
 
     cat <<EOF > /etc/apt/sources.list
-deb http://deb.debian.org/debian bookworm main contrib non-free-firmware
-deb http://deb.debian.org/debian bookworm-updates main contrib non-free-firmware
-deb http://security.debian.org/debian-security bookworm-security main contrib non-free-firmware
+deb http://deb.debian.org/debian trixie main contrib non-free-firmware
+deb http://deb.debian.org/debian trixie-updates main contrib non-free-firmware
+deb http://security.debian.org/debian-security trixie-security main contrib non-free-firmware
 EOF
 
-    apt update && apt install -y intel-microcode linux-image-${KERNEL_VERSION}-amd64
+    apt update && apt install -y intel-microcode linux-image-${KERNEL_VERSION}-amd64 linux-cpupower
 fi
 
 # Remove WIFI, netronome, v4l and liquidio firmware to save ~300MB image size

docker-bake.hcl

@@ -17,8 +17,8 @@ target "_common" {
 target "_common_args" {
     args = {
         IGNITION_BRANCH = "v0.36.2"
-        GOLLDPD_VERSION = "v0.4.10"
-        CRI_VERSION = "v1.34.0"
+        GOLLDPD_VERSION = "v0.4.12"
+        CRI_VERSION = "v1.35.0"
         ICE_VERSION = "2.4.5"
         ICE_PKG_VERSION = "1.3.53.0"
     }
@@ -46,15 +46,15 @@ target "debian" {
     }
     args = {
         BASE_OS_NAME = "debian"
-        BASE_OS_VERSION = "bookworm"
+        BASE_OS_VERSION = "trixie"
         DOCKER_APT_OS = "debian"
-        DOCKER_APT_CHANNEL ="bookworm"
+        DOCKER_APT_CHANNEL ="trixie"
         FRR_VERSION ="frr-10.4"
-        FRR_VERSION_DETAIL ="10.4.4-0~deb12u1"
-        FRR_APT_CHANNEL ="bookworm"
-      # see https://packages.debian.org/bookworm/kernel/ for available versions
-        KERNEL_VERSION = "6.1.0-49"
-        CONTAINERD_VERSION = "2.1.5-1~debian.12~bookworm"
+        FRR_VERSION_DETAIL ="10.4.4-0~deb13u1"
+        FRR_APT_CHANNEL ="trixie"
+      # see https://packages.debian.org/trixie/kernel/ for available versions
+        KERNEL_VERSION = "6.12.90+deb13"
+        CONTAINERD_VERSION = "2.1.5-1~debian.13~trixie"
     }
     tags = ["ghcr.io/metal-stack/debian:${SEMVER_MAJOR_MINOR}${SEMVER_PATCH}"]
 }
@@ -70,7 +70,7 @@ target "debian-firewall" {
 }
 
 target "debian-nvidia" {
-    inherits = ["_common"]
+    inherits = ["_common", "debian"]
     dockerfile = "./debian-nvidia/Dockerfile"
     contexts = {
         baseapp = "target:debian"

firewall/Dockerfile

@@ -1,7 +1,7 @@
 ARG DROPTAILER_VERSION=v0.2.19
 ARG FIREWALL_CONTROLLER_VERSION=v2.4.2
 ARG TAILSCALE_VERSION=v1.90.6
-ARG NODE_EXPORTER_VERSION=v1.10.2
+ARG NODE_EXPORTER_VERSION=v1.11.1
 
 FROM ghcr.io/metal-stack/droptailer-client:${DROPTAILER_VERSION} AS droptailer-artifacts