RE1-T119 Migrating to Docker Hardened Images

Web/Resgrid.Web.Eventing/Dockerfile

@@ -1,12 +1,14 @@
 #See https://aka.ms/containerfastmode to understand how Visual Studio uses this Dockerfile to build your images for faster debugging.
 ARG BUILD_VERSION=3.5.0
 
-FROM mcr.microsoft.com/dotnet/aspnet:9.0.3-noble-amd64 AS base
+#FROM mcr.microsoft.com/dotnet/runtime:9.0.3-noble-amd64 AS base
+FROM dhi.io/dotnet:9.0.16-debian13@sha256:4797903e46b475875f4a402aa6f42a1dcc78cfe67d217f9f5f49e358b60d47a3 AS base
 ARG BUILD_VERSION
 WORKDIR /app
 EXPOSE 80
 
-FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
+#FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
+FROM dhi.io/dotnet:9.0.314-sdk-debian13@sha256:a3acd51de0af79878e26292b3053aab513c6ca4476ddb2f9f11adb9c04aa7c89 AS build
 ARG BUILD_VERSION
 WORKDIR /src
 COPY ["Web/Resgrid.Web.Eventing/Resgrid.Web.Eventing.csproj", "Web/Resgrid.Web.Eventing/"]
@@ -24,12 +26,11 @@ WORKDIR "/src/Web/Resgrid.Web.Eventing"
 FROM build AS publish
 ARG BUILD_VERSION
 RUN dotnet publish "Resgrid.Web.Eventing.csproj" -c Release -o /app/publish  -p:Version=${BUILD_VERSION}
+ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait /app/publish/wait
+RUN chmod +x /app/publish/wait
 
 FROM base AS final
-## Add the wait script to the image
-ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait wait
-RUN chmod +x wait
-
 WORKDIR /app
 COPY --from=publish /app/publish .
-ENTRYPOINT ["sh", "-c", "./wait && dotnet Resgrid.Web.Eventing.dll"]
+ENTRYPOINT ["./wait"]
+CMD ["dotnet", "Resgrid.Web.Eventing.dll"]

Web/Resgrid.Web.Mcp/Dockerfile

@@ -2,12 +2,14 @@
 
 ARG BUILD_VERSION=3.5.0
 
-FROM mcr.microsoft.com/dotnet/aspnet:9.0.3-noble-amd64 AS base
+#FROM mcr.microsoft.com/dotnet/runtime:9.0.3-noble-amd64 AS base
+FROM dhi.io/dotnet:9.0.16-debian13@sha256:4797903e46b475875f4a402aa6f42a1dcc78cfe67d217f9f5f49e358b60d47a3 AS base
 ARG BUILD_VERSION
 WORKDIR /app
 EXPOSE 8080
 
-FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
+#FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
+FROM dhi.io/dotnet:9.0.314-sdk-debian13@sha256:a3acd51de0af79878e26292b3053aab513c6ca4476ddb2f9f11adb9c04aa7c89 AS build
 ARG BUILD_VERSION
 WORKDIR /src
 COPY ["Web/Resgrid.Web.Mcp/Resgrid.Web.Mcp.csproj", "Web/Resgrid.Web.Mcp/"]
@@ -35,13 +37,11 @@ WORKDIR "/src/Web/Resgrid.Web.Mcp"
 FROM build AS publish
 ARG BUILD_VERSION
 RUN dotnet publish "Resgrid.Web.Mcp.csproj" -c Release -o /app/publish -p:Version=${BUILD_VERSION}
+ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait /app/publish/wait
+RUN chmod +x /app/publish/wait
 
 FROM base AS final
-## Add the wait script to the image
-ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait wait
-RUN chmod +x wait
-
 WORKDIR /app
 COPY --from=publish /app/publish .
-
-ENTRYPOINT ["sh", "-c", "./wait && dotnet Resgrid.Web.Mcp.dll"]
+ENTRYPOINT ["./wait"]
+CMD ["dotnet", "Resgrid.Web.Mcp.dll"]

Web/Resgrid.Web.Services/Dockerfile

@@ -2,12 +2,14 @@
 
 ARG BUILD_VERSION=3.5.0
 
-FROM mcr.microsoft.com/dotnet/aspnet:9.0.3-noble-amd64 AS base
+#FROM mcr.microsoft.com/dotnet/runtime:9.0.3-noble-amd64 AS base
+FROM dhi.io/dotnet:9.0.16-debian13@sha256:4797903e46b475875f4a402aa6f42a1dcc78cfe67d217f9f5f49e358b60d47a3 AS base
 ARG BUILD_VERSION
 WORKDIR /app
 EXPOSE 80
 
-FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
+#FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
+FROM dhi.io/dotnet:9.0.314-sdk-debian13@sha256:a3acd51de0af79878e26292b3053aab513c6ca4476ddb2f9f11adb9c04aa7c89 AS build
 ARG BUILD_VERSION
 WORKDIR /src
 COPY ["Web/Resgrid.Web.Services/Resgrid.Web.Services.csproj", "Web/Resgrid.Web.Services/"]
@@ -35,12 +37,11 @@ WORKDIR "/src/Web/Resgrid.Web.Services"
 FROM build AS publish
 ARG BUILD_VERSION
 RUN dotnet publish "Resgrid.Web.Services.csproj" -c Release -o /app/publish -p:Version=${BUILD_VERSION}
+ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait /app/publish/wait
+RUN chmod +x /app/publish/wait
 
 FROM base AS final
-## Add the wait script to the image
-ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait wait
-RUN chmod +x wait
-
 WORKDIR /app
 COPY --from=publish /app/publish .
-ENTRYPOINT ["sh", "-c", "./wait && dotnet Resgrid.Web.Services.dll"]
+ENTRYPOINT ["./wait"]
+CMD ["dotnet", "Resgrid.Web.Services.dll"]

Web/Resgrid.Web.Tts/Dockerfile

@@ -1,11 +1,13 @@
 ARG BUILD_VERSION=3.5.0
 
-FROM mcr.microsoft.com/dotnet/aspnet:9.0.3-noble-amd64 AS base
+#FROM mcr.microsoft.com/dotnet/runtime:9.0.3-noble-amd64 AS base
+FROM dhi.io/dotnet:9.0.16-debian13@sha256:4797903e46b475875f4a402aa6f42a1dcc78cfe67d217f9f5f49e358b60d47a3 AS base
 ARG BUILD_VERSION
 WORKDIR /app
 EXPOSE 8080
 
-FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
+#FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
+FROM dhi.io/dotnet:9.0.314-sdk-debian13@sha256:a3acd51de0af79878e26292b3053aab513c6ca4476ddb2f9f11adb9c04aa7c89 AS build
 ARG BUILD_VERSION
 WORKDIR /src
 
@@ -64,4 +66,4 @@ COPY --from=build /app/publish .
 
 ENV ASPNETCORE_URLS=http://+:8080
 USER appuser
-ENTRYPOINT ["dotnet", "Resgrid.Web.Tts.dll"]
+ENTRYPOINT ["dotnet", "Resgrid.Web.Tts.dll"]

Web/Resgrid.Web/Dockerfile

@@ -1,13 +1,15 @@
 #See https://aka.ms/containerfastmode to understand how Visual Studio uses this Dockerfile to build your images for faster debugging.
 ARG BUILD_VERSION=3.5.0
 
-FROM mcr.microsoft.com/dotnet/aspnet:9.0.3-noble-amd64 AS base
+#FROM mcr.microsoft.com/dotnet/aspnet:9.0.3-noble-amd64 AS base
+FROM dhi.io/aspnetcore:9.0.16-debian13@sha256:961647e80202ce33fc06472dda4e7ae2d2bc56d819aee6742602f70047b13dc7 AS base
 ARG BUILD_VERSION
 WORKDIR /app
 EXPOSE 80
 
 #FROM node:18.19-alpine3.19 AS node_base
-FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
+#FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
+FROM dhi.io/dotnet:9.0.314-sdk-debian13@sha256:a3acd51de0af79878e26292b3053aab513c6ca4476ddb2f9f11adb9c04aa7c89 AS build
 #RUN apt-get update && apt-get install nodejs
 #COPY --from=node_base . .
 #COPY --from=node_base /usr/lib /usr/lib
@@ -52,12 +54,12 @@ ENV PATH="${PATH}:/root/.dotnet/tools"
 RUN for i in 1 2 3; do libman restore && break || { echo "libman restore attempt $i failed, retrying..."; sleep 10; }; done
 ENV SKIP_LIBMAN_RESTORE=1
 RUN dotnet publish "Resgrid.Web.csproj" -c Release -o /app/publish -p:Version=${BUILD_VERSION}
+## Download the wait script in the build stage where a shell is available
+ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait /app/publish/wait
+RUN chmod +x /app/publish/wait
 
 FROM base AS final
-## Add the wait script to the image
-ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait wait
-RUN chmod +x wait
-
 WORKDIR /app
 COPY --from=publish /app/publish .
-ENTRYPOINT ["sh", "-c", "./wait && dotnet Resgrid.Web.dll"]
+ENTRYPOINT ["./wait"]
+CMD ["dotnet", "Resgrid.Web.dll"]

Workers/Resgrid.Workers.Console/Dockerfile

@@ -1,11 +1,13 @@
 #See https://aka.ms/containerfastmode to understand how Visual Studio uses this Dockerfile to build your images for faster debugging.
 ARG BUILD_VERSION=3.5.0
 
-FROM mcr.microsoft.com/dotnet/runtime:9.0.3-noble-amd64 AS base
+#FROM mcr.microsoft.com/dotnet/runtime:9.0.3-noble-amd64 AS base
+FROM dhi.io/dotnet:9.0.16-debian13@sha256:4797903e46b475875f4a402aa6f42a1dcc78cfe67d217f9f5f49e358b60d47a3 AS base
 ARG BUILD_VERSION
 WORKDIR /app
 
-FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
+#FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
+FROM dhi.io/dotnet:9.0.314-sdk-debian13@sha256:a3acd51de0af79878e26292b3053aab513c6ca4476ddb2f9f11adb9c04aa7c89 AS build
 ARG BUILD_VERSION
 WORKDIR /src
 
@@ -35,16 +37,15 @@ WORKDIR "/src/Workers/Resgrid.Workers.Console"
 FROM build AS publish
 ARG BUILD_VERSION
 RUN dotnet publish "Resgrid.Workers.Console.csproj" -c Release -o /app/publish -p:Version=${BUILD_VERSION}
+ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait /app/publish/wait
+RUN chmod +x /app/publish/wait
 
 FROM base AS final
-## Add the wait script to the image
-ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait wait
-RUN chmod +x wait
 
 WORKDIR /app
 
 ## START - INSTALL WKHTMLTOPDF
-ENV WKHTMLTOX wkhtmltox_0.12.6.1-3.jammy_amd64.deb
+ENV WKHTMLTOX wkhtmltox_0.12.6.1-3.bookworm_amd64.deb
 ENV BUILD_PACKAGES build-essential
 ENV MAIN_PACKAGES apt-transport-https wget libfontconfig1-dev libfreetype6-dev libjpeg-dev libpng-dev libssl-dev libx11-dev libxext-dev libxrender-dev xfonts-75dpi xfonts-base zlib1g-dev fontconfig
 
@@ -53,16 +54,17 @@ RUN apt-get update && apt-get install -y $MAIN_PACKAGES
 RUN set -xe \
     && apt-get update -qq \
     && apt-get install --no-install-recommends -yq $BUILD_PACKAGES \
-    && wget https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6.1-3/wkhtmltox_0.12.6.1-3.jammy_amd64.deb \
+    && wget https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6.1-3/wkhtmltox_0.12.6.1-3.bookworm_amd64.deb \
     && dpkg -i ${WKHTMLTOX} \
     && apt-get remove -y $BUILD_PACKAGES \
     && apt-get autoremove -y \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
     && rm -rf ${WKHTMLTOX} \
     && truncate -s 0 /var/log/*log
-## END - INSTALL WKHTMLTPDF
+## END - INSTALL WKHTMLTOPDF
 
 COPY --from=publish /app/publish .
 
-ENTRYPOINT ["sh", "-c", "./wait && dotnet Resgrid.Workers.Console.dll"]
+ENTRYPOINT ["./wait"]
+CMD ["dotnet", "Resgrid.Workers.Console.dll"]