To move an image from Debian 12 to 13, change the base tag, rebuild, run your tests, and compare the package lists before and after. Read Debian's release notes for items that affect you, especially architecture support and packages with limited security coverage. Do it service by service.
Start with the release notes
Debian publishes release notes for trixie, with an "issues" page for things to know about. Most of it is aimed at full systems, and some items do not apply to a container. Read the list with your own image in mind rather than treating every item as a task.
Items worth checking for containers:
- Architectures. Trixie lists amd64, arm64, armel, armhf, ppc64el, riscv64 and s390x as supported, with a partial 32-bit i386 userland on 64-bit PCs. Debian also says i386 is no longer supported as a regular architecture and that armel is at its last release. If you build for 32-bit targets, check this first.
- Skip upgrades. Debian says upgrades must go one release at a time, which matters if you have images still on 11.
- Software with its own notes. The issues page lists notes for services such as RabbitMQ and MariaDB. If your image packages one of those from Debian, read its section.
Know the limits on Go and Rust packages
The release notes state that Debian's infrastructure has problems rebuilding packages that use static linking. They say Go and Rust based packages will be covered by limited security support, and that updates for Go or Rust development libraries will in most cases arrive only through regular point releases.
For a container this has a plain consequence. If your image gets a Go or Rust binary from a Debian package, do not rely on the distribution for timely fixes. Build the binary yourself with a current toolchain, or take it from the project's own releases, and track it in your SBOM.
The upgrade steps
- Pick one low risk service as the pilot.
- Change the tag from bookworm to trixie, keeping the same variant such as slim.
- Rebuild with a fresh pull of the base.
- Run unit tests, then the smoke test: start the container and send a real request.
- Compare package lists. Generate an SBOM for the old and new builds and diff them. Look at library major versions, not only counts.
- Scan the new image and read what is left, so you know your starting point.
- Pin the new base by digest and roll it out in waves.
What usually breaks
Expect differences in shared library versions, default configuration of bundled tools, and runtimes that were compiled against an older library. Native extensions for languages like Python or Node are the first thing to test, because they link against system libraries.
Record the result
Write down the date, the old and new base, and the SBOM diff in the pull request. If a service cannot move yet, record an exception with an owner and an end date. Debian lists bookworm LTS until 30 June 2028, so there is room, but not room to forget.
Where Safeguard fits
Safeguard produces an SBOM and scan for each image, so the before and after comparison in step 5 and the baseline in step 6 come from the same tooling. The free scan at https://gold.safeguard.sh/scan handles a single image.
Quick check
Can I jump from Debian 11 straight to 13?
Debian says skip upgrades are not supported for installed systems. For a container you rebuild from a new base, but test in two steps anyway if the application is old, so you can tell which change broke what.
Do I need to change anything for Go services?
If you compile your own Go binary in a build stage, little changes. If you install a Go program from a Debian package, check how it will receive fixes.
Sources
Last reviewed: 19 October 2026.
