Docker & Containerization

# Building a console app: runtime is sufficient (smaller than aspnet)
FROM mcr.microsoft.com/dotnet/runtime:8.0 AS final

# Building a web API: needs aspnet for Kestrel, MVC, etc.
FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS final

Common follow-ups: What's the size difference between these base image variants?;What is the runtime-deps image and when would you use it instead?

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
WORKDIR /src
COPY *.csproj .
RUN dotnet restore
COPY . .
RUN dotnet publish -c Release -o /app/publish

FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS final
WORKDIR /app
COPY --from=build /app/publish .
ENTRYPOINT ["dotnet", "MyApp.dll"]

Common follow-ups: Why copy the .csproj file separately before the rest of the source code?;How many stages can a Dockerfile have, and when would you need more than two?

# Optimized layer caching:
COPY *.csproj .
RUN dotnet restore          # cached as long as .csproj is unchanged
COPY . .                    # this layer invalidates on every code change
RUN dotnet publish -c Release -o /app/publish  # but restore step above stays cached

Common follow-ups: How does this pattern extend to multi-project solutions with several .csproj files?;What invalidates the restore layer's cache even without dependency changes?

# Kubernetes resource limits automatically respected by the .NET runtime:
resources:
  limits:
    memory: "512Mi"
    cpu: "1"
# .NET's GC targets a heap size appropriate for 512Mi, not the node's full memory

Common follow-ups: How do you override the automatic detection if it doesn't behave as expected?;What environment variables control GC heap limits explicitly?

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
WORKDIR /src
COPY . .
RUN dotnet publish -c Release -r linux-x64 -p:PublishAot=true -o /app

FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-jammy-chiseled AS final
WORKDIR /app
COPY --from=build /app .
ENTRYPOINT ["/app/MyApp"]

Common follow-ups: What is a 'chiseled' Ubuntu container image and how does it improve security?;What functionality is lost by adopting Native AOT (reflection-heavy libraries, etc.)?

FROM mcr.microsoft.com/dotnet/aspnet:8.0
WORKDIR /app
COPY --from=build /app/publish .
USER app  # switch to the built-in non-root user
ENTRYPOINT ["dotnet", "MyApp.dll"]

Common follow-ups: What port-binding limitations does running as non-root introduce (ports below 1024)?;How do you configure file permissions correctly when running as a non-root user?

# Kubernetes deployment with a fractional CPU limit
resources:
  limits:
    cpu: "1.5"  # .NET runtime detects this and sizes ThreadPool/GC accordingly

# Can be explicitly overridden if detection seems off:
# DOTNET_PROCESSOR_COUNT=2

Common follow-ups: How would you verify what CPU count the runtime actually detected?;Why do fractional CPU limits pose an inherently harder detection problem than whole-number limits?

# docker-compose.yml
services:
  api:
    build: .
    ports: ["8080:8080"]
    environment:
      - ConnectionStrings__Db=Host=db;Database=myapp
    depends_on: [db, redis]
  db:
    image: postgres:16
    environment: ["POSTGRES_PASSWORD=devpassword"]
  redis:
    image: redis:7

Common follow-ups: How does depends_on differ from actually waiting for a dependency to be ready?;How does .NET Aspire relate to and potentially replace Docker Compose for local orchestration?

// AppHost Program.cs
var builder = DistributedApplication.CreateBuilder(args);
var redis = builder.AddRedis("cache");
var db = builder.AddPostgres("postgres").AddDatabase("orders");
var api = builder.AddProject<Projects.OrderApi>("orderapi")
    .WithReference(redis)
    .WithReference(db);
builder.Build().Run();

Common follow-ups: How does Aspire's service discovery work without a full service mesh?;How does Aspire relate to actual production deployment versus just local development?

docker run -e ConnectionStrings__Db="Server=prod-db;..." -e ASPNETCORE_ENVIRONMENT=Production myapp:latest

# Or in Kubernetes:
env:
  - name: ConnectionStrings__Db
    valueFrom: { secretKeyRef: { name: db-secret, key: connection-string } }

Common follow-ups: How do you handle secrets specifically (versus regular config) in a Kubernetes environment variable setup?;What ASPNETCORE_ENVIRONMENT value should each deployment tier use?