[itsakashp]

Description

Addresses the base-image part of #592.

The runtime image is built from debian:12 with unpinned, never-upgraded packages, so the published image carries a large number of OS-level CVEs. This PR:

• moves the base to debian:13-slim (current Debian stable, slim variant)
• runs apt-get upgrade -y so the image picks up security fixes released after the base image was built
• installs ca-certificates and curl with --no-install-recommends (curl is kept so existing HEALTHCHECK/exec-based probes keep working)
• removes the apt lists to keep the layer small

Trivy scan of the OS layer, using the same v1.30.0 chproxy binary in both images:

Image	Critical	High	Medium	Low	Total	Fixable
contentsquareplatform/chproxy:v1.30.0 (debian 12.12)	8	116	193	208	530	166
this PR (debian 13-slim)	0	47	91	142	281	0

Image size goes from 261 MB to 158 MB. The remaining findings have no fix available in Debian yet, so the next rebuild will pick them up through apt-get upgrade.

Note: findings in the Go binary itself (Go 1.24 stdlib, golang.org/x/*) are not covered here. Those need a Go toolchain/dependency bump and are better handled in a separate PR, which keeps this one limited to the image.

Pull request type

• Bugfix
• Feature
• Code style update (formatting, renaming)
• Refactoring (no functional changes, no api changes)
• Build related changes
• Documentation content changes
• Other (please describe):

Checklist

• Linter passes correctly (N/A: no Go code changed)
• Add tests which fail without the change (if possible)
• All tests passing (N/A: no Go code changed)
• Extended the README / documentation, if necessary

Does this introduce a breaking change?

• Yes
• No

The entrypoint, exposed port, user and available tools (curl, CA bundle) are unchanged. The chproxy binary is statically linked (CGO_ENABLED=0), so the libc change does not affect it.

Further comments

Verified locally: chproxy -version runs, and curl makes HTTPS requests using the CA bundle.

This overlaps with #545 (non-root user), which also edits the Dockerfile. Whichever merges second will need a small rebase, and I'm happy to do it.

I considered distroless/static or scratch, which would remove nearly all OS CVEs. I didn't use them here because they would drop curl and the shell, which would break users who rely on them for health checks.