Build an immutable multi-stage image, run as a non-root user, expose only the application port, and keep environment-specific configuration outside the image. Example: FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build WORKDIR /src COPY . . RUN dotnet publish -c Release -o /app --no-self-contained FROM mcr.microsoft.com/dotnet/aspnet:8.0 WORKDIR /app COPY --from=build /app . USER $APP_UID ENTRYPOINT ["dotnet", "Api.dll"] Pin supported base versions/digests, scan dependencies and images, add readiness/liveness endpoints, set CPU/memory limits, and handle SIGTERM gracefully. Inject secrets through a secret store or mounted file, never build arguments or committed appsettings files.
Backbencher Developer · · 0 likes