copilot-instructions docker.instructions.md

Multi-stage Builds

• ALWAYS use template .github/templates/dotnet-dockerfile-template as base for .NET projects
• Do not assemble a full Dockerfile directly from the snippets in this instruction when the template applies; use the template as the concrete starting point and treat snippets here as partial patterns.
• stages build/publish/base/final
• copy only required artifacts
• fixed NetToolsKit layout (src/, samples/, eng/, .build/)

# Build stage
FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
WORKDIR /src
COPY ["src/MyApp/MyApp.csproj", "src/MyApp/"]
RUN dotnet restore "src/MyApp/MyApp.csproj"
COPY . .
WORKDIR "/src/src/MyApp"
RUN dotnet build "MyApp.csproj" -c Release -o /app/build

# Publish stage
FROM build AS publish
RUN dotnet publish "MyApp.csproj" -c Release -o /app/publish

# Final stage
FROM mcr.microsoft.com/dotnet/aspnet:8.0-alpine AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "MyApp.dll"]

Security

• Mandatory non-root user (pattern unet:gnet)
• distroless images when possible
• vulnerability scanning
• secrets via environment variables only

FROM mcr.microsoft.com/dotnet/aspnet:8.0-alpine AS base
RUN adduser -D -u 1001 unet && addgroup -S gnet && adduser unet gnet
USER unet:gnet
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "MyApp.dll"]

Performance

• Layer caching optimization
• COPY order (dependencies first)
• .dockerignore for exclusions
• minimize base image size

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
WORKDIR /src
COPY ["src/MyApp/MyApp.csproj", "."]
RUN dotnet restore
COPY . .
RUN dotnet build -c Release -o /app/build

Resource Limits

• Memory/CPU constraints
• health checks configured
• appropriate restart policies
• network security groups

version: '3.8'
services:
  myapp:
    image: myapp:latest
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.5'
          memory: 256M
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost/health/live"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    restart: unless-stopped