.NET Docker Images

Minimal .NET Docker images for production and CI/CD. Built on Wolfi, a security-focused Linux distribution designed for containers. All supported (non-EOL) .NET versions are rebuilt automatically.

Images

Version				Arch	EOL
.NET 10 (LTS)	runtime-10 runtime-lts	runtime-invariant-10 runtime-invariant-lts	sdk-10 sdk-lts		2028-11-14
.NET 9 (STS)	runtime-9 runtime-sts	runtime-invariant-9 runtime-invariant-sts	sdk-9 sdk-sts		2026-11-10
.NET 8	runtime-8	runtime-invariant-8	sdk-8		2026-11-10

Variants

Variant	Includes	Shell	ICU/Globalization	User
runtime	ASP.NET Core runtime	No	Yes	65532 (nonroot)
runtime-invariant	ASP.NET Core runtime	No	No (invariant mode)	65532 (nonroot)
sdk	.NET SDK + bash, git, curl	Yes (bash)	Yes	65532 (nonroot)

• runtime - Full globalization support (ICU + tzdata). Use this for apps that need locale-aware formatting, time zones, or culture-specific behavior.
• runtime-invariant - No ICU or tzdata. Smallest image size. Use this for APIs that only need UTC and ordinal string comparison.
• sdk - Everything needed to build .NET apps. Uses DOTNET_CLI_HOME=/home/nonroot for NuGet cache — no root required. Use COPY --chown=nonroot to make source files writable.

Why Wolfi?

Wolfi is a lightweight Linux distribution built specifically for containers. It provides:

• Minimal footprint - Only essential packages, nothing extra
• Daily security updates - Patches applied quickly
• Designed for containers - No legacy cruft from traditional distros

Features

• Lightweight - Optimized for fast CI/CD pulls
• Secure - Built on Wolfi with continuous vulnerability scanning
• Multi-arch - Supports both linux/amd64 and linux/arm64
• Non-root - Runtime images run as unprivileged user (UID 65532)
• Supply chain security - SBOM and SLSA provenance attestations included
• EOL-aware - Versions are automatically dropped when they reach end-of-life

Dockerfile Examples

Web API (recommended)

ARG BUILDPLATFORM
FROM --platform=$BUILDPLATFORM svrnty/dotnet:sdk-10 AS build

WORKDIR /app/source
COPY --chown=nonroot . .
WORKDIR /app/source/MyApp.Api

ARG TARGETARCH
RUN case "$TARGETARCH" in \
      amd64) ARCH=x64 ;; \
      arm64) ARCH=arm64 ;; \
      *) ARCH=$TARGETARCH ;; \
    esac && \
    dotnet publish -a $ARCH --self-contained false -o /app/publish

FROM svrnty/dotnet:runtime-invariant-10 AS final
WORKDIR /app
COPY --from=build /app/publish .
USER 65532
EXPOSE 8080
ENTRYPOINT ["/usr/share/dotnet/dotnet", "MyApp.Api.dll"]

Web API with globalization (ICU)

ARG BUILDPLATFORM
FROM --platform=$BUILDPLATFORM svrnty/dotnet:sdk-lts AS build

WORKDIR /app/source
COPY --chown=nonroot . .

ARG TARGETARCH
RUN case "$TARGETARCH" in \
      amd64) ARCH=x64 ;; \
      arm64) ARCH=arm64 ;; \
      *) ARCH=$TARGETARCH ;; \
    esac && \
    dotnet publish MyApp.sln -a $ARCH --self-contained false -o /app/publish

FROM svrnty/dotnet:runtime-lts AS final
WORKDIR /app
COPY --from=build /app/publish .
USER 65532
EXPOSE 8080
ENTRYPOINT ["/usr/share/dotnet/dotnet", "MyApp.dll"]

Worker service

ARG BUILDPLATFORM
FROM --platform=$BUILDPLATFORM svrnty/dotnet:sdk-10 AS build

WORKDIR /app/source
COPY --chown=nonroot . .

ARG TARGETARCH
RUN case "$TARGETARCH" in \
      amd64) ARCH=x64 ;; \
      arm64) ARCH=arm64 ;; \
      *) ARCH=$TARGETARCH ;; \
    esac && \
    dotnet publish MyWorker -a $ARCH --self-contained false -o /app/publish

FROM svrnty/dotnet:runtime-invariant-10 AS final
WORKDIR /app
COPY --from=build /app/publish .
USER 65532
ENTRYPOINT ["/usr/share/dotnet/dotnet", "MyWorker.dll"]

CI/CD (Gitea/GitHub Actions)

jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: svrnty/dotnet:sdk-lts
    steps:
      - uses: actions/checkout@v4
      - run: dotnet restore
      - run: dotnet test --no-restore
      - run: dotnet publish -c Release -o /app

Tags

Each variant is tagged with:

• <variant>-<major> - Latest patch for a major version (e.g., runtime-10)
• <variant>-<version> - Exact version pin (e.g., runtime-10.0.2, sdk-10.0.102)
• <variant>-lts - Floating tag pointing to the highest active LTS (currently .NET 10)
• <variant>-sts - Floating tag pointing to the highest active STS (currently .NET 9)

Automatic Updates

Images are automatically rebuilt when:

• New .NET patch versions are released (daily check)
• Base image security updates are available (weekly rebuild)
• A .NET version reaches EOL, it is automatically excluded

Every build is scanned with Docker Scout and includes supply chain attestations (SBOM, SLSA provenance).

License

MIT