.NET Containers advancements in .NET 8

This is a summary of .NET Containers advancements in .NET 8 on .Net Conf 2023.

It is requied from communitity for .Net Container Images to be

• Small (registry pull faster)

• Secure (non-root; no shell or package manager)

• Compliant (minimal dependencies, easy audit)

• Composable (e.g. add locallication when needed)

• Compatible (glibc vs musl libc)

• Supported (part of a support contract / lifecycle)

Ubuntu Chiseled .NET images

Ubuntu Chiseled .NET images are a type of "distroless" container image that contain only the minimal set of packages .NET needs, with everything else removed. These images offer dramatically smaller deployment sizes and attack surface by including only the minimal set of packages required to run .NET applications.

Please see the Ubuntu Chiseled + .NET documentation page for more info.

Container Size Improvements

.Net Containers in General

How to Publish Your Application?

First add the below package from Nuget.

dotnet add package Microsoft.NET.Build.Containers --version 8.0.100

Then, publish your container using .NET CLI. I am using -r linux-x64, because I am on Windows.

dotnet publish -t:PublishContainer -r linux-x64

Then your application is published as a container to your local registry without any Dockerfile as below.

However, the size of the image will be big. We need to shrink the size of the container.

To shrink, add the PublishTrimmed and ContainerFamily to your csproj file.

<PropertyGroup>
....
    <PublishTrimmed>true</PublishTrimmed>
    <ContainerFamily>jammy-chiseled</ContainerFamily>
....
<PropertyGroup>

Then publish your project again.

dotnet publish -t:PublishContainer -r linux-x64 -p ContainerImageTag=chiseled

You will see that the size is reduced now.

You can also publish your app as Native AOT. Add the below to your csproj file.

<PublishAot>True</PublishAot>

dotnet publish -t:PublishContainer -r linux-x64 -p ContainerImageTag=aot

You can also specify the base image for the container.

<ContainerBaseImage>mcr.microsoft.com/dotnet/nightly/runtime:8.0</ContainerBaseImage>

I believe that creating containers without Dockerfile is a life-saving feature for developers. You can check the documentation for more information.