KyuubiYoru
b235670afd
The 10.0.9 ASP.NET chiseled base shipped Microsoft.NETCore.App 10.0.9, which the release trivy gate flags with six HIGH advisories: CVE-2026-47302, CVE-2026-50524, CVE-2026-50528, CVE-2026-50651 and CVE-2026-57108 (fixed in 10.0.10) plus CVE-2026-62901 (fixed in 10.0.11). Move the runtime stage to 10.0.11-noble-chiseled, pinned by multi-architecture manifest digest as before, so every finding clears in one step. The build stage keeps SDK 10.0.301: the published server is framework dependent, so the shipped runtime comes from the aspnet base alone and the discarded builder layer is never scanned.
36 lines
1.8 KiB
Docker
36 lines
1.8 KiB
Docker
# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
|
|
FROM mcr.microsoft.com/dotnet/sdk:10.0.301-noble@sha256:ea8bde36c11b6e7eec2656d0e59101d4462f6bd630730f2c8201ed0572b295d5 AS build
|
|
ARG SOURCE_REVISION_ID
|
|
|
|
WORKDIR /source
|
|
COPY Directory.Build.props Directory.Packages.props NuGet.config global.json Rendezvous.slnx ./
|
|
COPY eng/Versions.props eng/Versions.props
|
|
COPY src/FinalFactory.Rendezvous.Contracts/FinalFactory.Rendezvous.Contracts.csproj src/FinalFactory.Rendezvous.Contracts/packages.lock.json src/FinalFactory.Rendezvous.Contracts/
|
|
COPY src/FinalFactory.Rendezvous.Server/FinalFactory.Rendezvous.Server.csproj src/FinalFactory.Rendezvous.Server/packages.lock.json src/FinalFactory.Rendezvous.Server/
|
|
RUN dotnet restore src/FinalFactory.Rendezvous.Server/FinalFactory.Rendezvous.Server.csproj --locked-mode
|
|
|
|
COPY src/FinalFactory.Rendezvous.Contracts/ src/FinalFactory.Rendezvous.Contracts/
|
|
COPY src/FinalFactory.Rendezvous.Server/ src/FinalFactory.Rendezvous.Server/
|
|
RUN dotnet publish src/FinalFactory.Rendezvous.Server/FinalFactory.Rendezvous.Server.csproj \
|
|
--configuration Release \
|
|
--no-restore \
|
|
--output /out \
|
|
/p:UseAppHost=false \
|
|
/p:OpenApiGenerateDocuments=false \
|
|
/p:ContinuousIntegrationBuild=true \
|
|
/p:RepositoryCommit="$SOURCE_REVISION_ID" \
|
|
/p:SourceRevisionId="$SOURCE_REVISION_ID"
|
|
|
|
FROM mcr.microsoft.com/dotnet/aspnet:10.0.11-noble-chiseled@sha256:0839314d08bb65da369135389a5d8291f75ace587fbb0488f469eb92c62eef68 AS runtime
|
|
|
|
ENV ASPNETCORE_HTTP_PORTS=8080 \
|
|
DOTNET_EnableDiagnostics=0 \
|
|
DOTNET_CLI_TELEMETRY_OPTOUT=1 \
|
|
TMPDIR=/tmp
|
|
WORKDIR /app
|
|
COPY --from=build --chown=1654:1654 /out/ ./
|
|
USER 1654:1654
|
|
EXPOSE 8080/tcp
|
|
EXPOSE 9050/udp
|
|
ENTRYPOINT ["dotnet", "FinalFactory.Rendezvous.Server.dll"]
|