Debian's release page lists 12 (bookworm) as the current oldstable release, with its regular end of life on 11 July 2026 and end of LTS on 30 June 2028. Images that start FROM bookworm keep running, but you should plan a move to trixie (13) and confirm who supplies fixes.
What the dates say
Debian describes a five year life cycle: three years of full support, then two years of Long Term Support (LTS). Here are the dates from the releases page when we fetched it.
| Release | Released | Regular end of life | End of LTS |
|---|---|---|---|
| 11 bullseye | 2021-08-14 | 2024-08-14 | 2026-08-31 |
| 12 bookworm | 2023-06-10 | 2026-07-11 | 2028-06-30 |
| 13 trixie | 2025-08-09 | 2028-08-09 | 2030-06-30 |
So bookworm is past its regular window and inside the LTS window. Bullseye has already left LTS.
Why LTS is a different arrangement
Debian's LTS page says LTS is not handled by the Debian security team. A separate group of volunteers and companies takes over security maintenance once the Debian Security team stops. That is not a reason to panic. It is a reason to treat bookworm as a base you are leaving, not one you are settling into.
What this means for a container image
A base image tag is a pointer that the publisher moves. Whether bookworm or bookworm-slim is rebuilt in the future is the publisher's decision, so read the tag listing for the image you use instead of assuming. On the official Debian image page we fetched, bookworm tags were dated 5 October 2026, which shows they were still being rebuilt at that point.
Your own image is a snapshot. It only picks up fixes when you rebuild from a refreshed base and redeploy. An old bookworm image that nobody rebuilt is stale however the distribution is doing.
A short plan
- List every Dockerfile that uses a bookworm tag. A search for
bookwormin your repositories is a fair start, and image scans of running workloads catch the rest. - Sort them by exposure: internet facing first, internal batch jobs last.
- Pick a target. For most teams that is the trixie variant of the same image family.
- Rebuild one low risk service on trixie, run its tests, and compare the package list before and after.
- Roll the rest out in waves, and write the date you expect each service to finish.
- For anything that cannot move yet, record an exception with an owner and an end date.
Try it yourself
Click through it at your own pace, or open it full screen. Look for how the scan separates operating system packages from application libraries, because the bookworm question lives in the first group.
Where Safeguard fits
Safeguard's container image scan reports the base operating system and its packages, and the SBOM it produces gives you a per image record you can search for every service still on bookworm. The free scan at https://gold.safeguard.sh/scan is a quick way to look at one image.
Quick check
Is a bookworm image unsafe to run now?
Not automatically. It is past regular support and inside LTS, so fixes come from a different group. What matters is whether your image was rebuilt recently and whether you have a dated plan to move.
Do I have to leave bookworm before 2028?
Debian lists LTS for bookworm until 30 June 2028, so there is time. Starting earlier avoids a rush and lets you move in waves.
Sources
Last reviewed: 19 October 2026.
