🧱 QD-13151 Switch to DHI images

[tiulpin]

Pull Request Details

Description

Migrate Docker base images to Docker Hardened Images (DHI) and upgrade from Debian 12 (Bookworm) to Debian 13 (Trixie) for improved security and reduced CVEs. The plan is to update the images, run our image tests and, if everything works out, keep it, if not, we will revert.

Base Image Migrations

Dockerfile	Before	After	Notes
jvm-community.Dockerfile	debian:bookworm-slim	dhi.io/debian-base:trixie	DHI + Debian 13
dotnet-community.Dockerfile	debian:bookworm-slim	dhi.io/debian-base:trixie	DHI + Debian 13
cpp-community.Dockerfile	debian:bookworm-slim	dhi.io/debian-base:trixie	DHI + Debian 13, clang 20-21
cpp-community-bookworm.Dockerfile	(new file)	debian:bookworm-slim	Legacy clang 16-19
go.Dockerfile	golang:1.24-bookworm	dhi.io/golang:1.25-debian13-dev	DHI + Go 1.25
js.Dockerfile	node:22-bookworm-slim	dhi.io/node:22-debian13-dev	DHI + Debian 13
php.Dockerfile	php:8.4-cli-bookworm	dhi.io/php:8.4-dev	DHI
ruby.Dockerfile	ruby:3.x-slim-bookworm	dhi.io/ruby:3.x-debian13-dev	DHI + Debian 13
rust.Dockerfile	rust:1.88-slim-bookworm	dhi.io/rust:1-debian13-dev	DHI + Debian 13

CI Matrix Optimization

Restructured build groups for maximum parallelism (5 → 12 parallel jobs):

Group	Images	Description
jvm	4	jvm-community → jvm → python-community → python
dotnet	2	dotnet-community → dotnet
clang	4	clang 20-21 (Trixie)
clang-16	2	clang 16 (Bookworm)
clang-17	2	clang 17 (Bookworm)
clang-18	2	clang 18 (Bookworm)
clang-19	2	clang 19 (Bookworm)
go	1	standalone
js	1	standalone
php	1	standalone
rust	1	standalone
ruby	3	ruby 3.2, 3.3, 3.4

Breaking Changes

• Ruby 3.1 removed: No DHI equivalent available
• Clang removed: But we keep the old bookworm image in case the old versions are still needed

Related Issue

https://youtrack.jetbrains.com/issue/QD-13151

Motivation and Context

• Security: DHI images have fewer CVEs, smaller attack surface, and include SBOM + SLSA Build Level 3 provenance
• Performance: Smaller image sizes, faster pulls
• Modernization: Debian 13 (Trixie) is the current stable release
• CI Speed: ~50% faster builds through increased parallelism (12 vs 5 jobs)

How Has This Been Tested

• Built all image groups locally with docker buildx bake
• Verified arm64 and amd64 builds pass
• Validated all bake groups resolve correctly

Types of changes

• Docs change / refactoring / dependency upgrade
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• I have read the CONTRIBUTING document.
• My code follows the code style of this project.
• My commit messages are styled with gitmoji
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

[github-actions]

Qodana for Go

421 new problems were found

Inspection name	Severity	Problems
Check GO source code coverage	🔶 Warning	397
Interprocedural potential nil dereference	🔶 Warning	5
Potential resource leak	🔶 Warning	5
Redundant 'else' in 'if'	◽️ Notice	14

@@ Code coverage @@
- 43% total lines covered
9285 lines analyzed, 4068 lines covered
# Calculated according to the filters of your coverage tool

☁️ View the detailed Qodana report

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions

[github-actions]

This pull request has been automatically marked as stale because it has not had recent activity for 7 days.

What happens next?

• If this PR is still relevant, please add a comment or push new commits to keep it active
• If no activity occurs within 3 days, this PR will be automatically closed
• You can always reopen the PR later if needed
• You can also add a label 'wip' to keep the PR open

Thank you for your contribution! 🙏

[github-actions]

Qodana for Go

1 new problem were found

Inspection name	Severity	Problems
Check GO source code coverage	🔶 Warning	1

@@ Code coverage @@
+ 61% total lines covered
9161 lines analyzed, 5622 lines covered
# Calculated according to the filters of your coverage tool

☁️ View the detailed Qodana report

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions