Bump distroless Docker base images to Debian 13

[Copilot]

Proposed Changes

• Updated gcr.io/distroless/static:nonroot → gcr.io/distroless/static-debian13:nonroot@sha256:01e550fdb7ab79ee7be5ff440a563a58f1fd000ad9e0c532e65c3d23f917f1c5 to explicitly pin Debian version and digest
• Updated gcr.io/distroless/base-debian12 → gcr.io/distroless/base-debian13:latest@sha256:8c8b7cf2a01e2d1c683128b2488d77139fa90ec8cb807f0ae260d57f7022dedd (pinned to specific digest)
• Both base images are now pinned to specific SHA256 digests for reproducible builds
• Base image uses :latest tag to enable root permissions during build stage for directory creation operations
• Runtime images explicitly set USER 65532:65532 to maintain nonroot security posture

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Bump distroless docker base images</issue_title>
<issue_description># Summary

Our Dockerfile uses distroless as base image in two places:

• https://github.com/ironcore-dev/ceph-provider/blob/main/Dockerfile#L73
• https://github.com/ironcore-dev/ceph-provider/blob/main/Dockerfile#L83

They should be updated to debian 13. See here for an overview of available images.

Motivation

Our base image gcr.io/distroless/static:nonroot is not tagged to a debian release. According to GoogleContainerTools/distroless#1851 (comment) this is not safe. We should make the debian 13 explicit.

The other base image gcr.io/distroless/base-debian12 is still using debian 12 and should be bumped to 13.
</issue_description>

<agent_instructions>Bump the docker base images as instructed in the issue. In addition, apply an explicit tag to the gcr.io/distroless/base-debian13 image.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Bump distroless docker base images #832

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.