Skip to content

RE1-T119 Migrating to Docker Hardened Images #380

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ucswift wants to merge 1 commit into
base: master
Choose a base branch
from
Open

RE1-T119 Migrating to Docker Hardened Images #380

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 8 additions & 7 deletions Web/Resgrid.Web.Eventing/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,14 @@
#See https://aka.ms/containerfastmode to understand how Visual Studio uses this Dockerfile to build your images for faster debugging.
ARG BUILD_VERSION=3.5.0

FROM mcr.microsoft.com/dotnet/aspnet:9.0.3-noble-amd64 AS base
#FROM mcr.microsoft.com/dotnet/runtime:9.0.3-noble-amd64 AS base
FROM dhi.io/dotnet:9.0.16-debian13 AS base
ARG BUILD_VERSION
WORKDIR /app
EXPOSE 80

FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
#FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
FROM dhi.io/dotnet:9.0.314-sdk-debian13 AS build
Comment on lines +5 to +11
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify all migrated Dockerfiles still use tag-only FROM references.
rg -n '^\s*FROM\s+dhi\.io\/[^\s]+' \
  Web/Resgrid.Web.Eventing/Dockerfile \
  Web/Resgrid.Web.Mcp/Dockerfile \
  Web/Resgrid.Web.Services/Dockerfile \
  Web/Resgrid.Web.Tts/Dockerfile \
  Web/Resgrid.Web/Dockerfile \
  Workers/Resgrid.Workers.Console/Dockerfile

# Expected follow-up: replace each with FROM ...@sha256:<digest>

Repository: Resgrid/Core

Length of output: 167

🏁 Script executed:

#!/bin/bash
# Fixed: use proper rg syntax to find all dhi.io FROM references
echo "=== Scanning for dhi.io references in Dockerfiles ==="
rg 'FROM\s+dhi\.io' -g 'Dockerfile*' -n

echo ""
echo "=== Checking each mentioned Dockerfile ==="
for dockerfile in \
  Web/Resgrid.Web.Eventing/Dockerfile \
  Web/Resgrid.Web.Mcp/Dockerfile \
  Web/Resgrid.Web.Services/Dockerfile \
  Web/Resgrid.Web.Tts/Dockerfile \
  Web/Resgrid.Web/Dockerfile \
  Workers/Resgrid.Workers.Console/Dockerfile; do
  if [ -f "$dockerfile" ]; then
    echo "--- $dockerfile ---"
    grep -n 'FROM.*dhi\.io' "$dockerfile" || echo "No dhi.io FROM found"
  else
    echo "$dockerfile: NOT FOUND"
  fi
done

Repository: Resgrid/Core

Length of output: 1986

Pin all dhi.io images by digest across the 6 migrated Dockerfiles.

All dhi.io FROM statements currently use tags only, leaving builds mutable. A retag can silently change runtime bits. Pin each reference with @sha256:<digest> to ensure deterministic, reproducible builds:

  • Web/Resgrid.Web.Eventing/Dockerfile (lines 5, 11)
  • Web/Resgrid.Web.Mcp/Dockerfile (lines 6, 12)
  • Web/Resgrid.Web.Services/Dockerfile (lines 6, 12)
  • Web/Resgrid.Web.Tts/Dockerfile (lines 4, 10)
  • Web/Resgrid.Web/Dockerfile (lines 5, 12)
  • Workers/Resgrid.Workers.Console/Dockerfile (lines 5, 10)
Suggested pattern 
-FROM dhi.io/dotnet:9.0.16-debian13 AS base
+FROM dhi.io/dotnet:9.0.16-debian13@sha256:<runtime_digest> AS base
...
-FROM dhi.io/dotnet:9.0.314-sdk-debian13 AS build
+FROM dhi.io/dotnet:9.0.314-sdk-debian13@sha256:<sdk_digest> AS build
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Web/Resgrid.Web.Eventing/Dockerfile` around lines 5 - 11, Replace all dhi.io
image tags used in FROM statements with immutable digest pins (use the
`@sha256`:<digest> form) so builds are reproducible; specifically update each
occurrence of images like dhi.io/dotnet:9.0.16-debian13 and
dhi.io/dotnet:9.0.314-sdk-debian13 (and any other dhi.io/* references) to their
corresponding sha256 digests in the Dockerfile FROM lines, ensuring both the
runtime and sdk images are pinned across all six migrated Dockerfiles.

ARG BUILD_VERSION
WORKDIR /src
COPY ["Web/Resgrid.Web.Eventing/Resgrid.Web.Eventing.csproj", "Web/Resgrid.Web.Eventing/"]
Expand All @@ -24,12 +26,11 @@ WORKDIR "/src/Web/Resgrid.Web.Eventing"
FROM build AS publish
ARG BUILD_VERSION
RUN dotnet publish "Resgrid.Web.Eventing.csproj" -c Release -o /app/publish -p:Version=${BUILD_VERSION}
ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait /app/publish/wait
RUN chmod +x /app/publish/wait

FROM base AS final
## Add the wait script to the image
ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait wait
RUN chmod +x wait

WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["sh", "-c", "./wait && dotnet Resgrid.Web.Eventing.dll"]
ENTRYPOINT ["./wait"]
CMD ["dotnet", "Resgrid.Web.Eventing.dll"]
16 changes: 8 additions & 8 deletions Web/Resgrid.Web.Mcp/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,14 @@

ARG BUILD_VERSION=3.5.0

FROM mcr.microsoft.com/dotnet/aspnet:9.0.3-noble-amd64 AS base
#FROM mcr.microsoft.com/dotnet/runtime:9.0.3-noble-amd64 AS base
FROM dhi.io/dotnet:9.0.16-debian13 AS base
ARG BUILD_VERSION
WORKDIR /app
EXPOSE 8080

FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
#FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
FROM dhi.io/dotnet:9.0.314-sdk-debian13 AS build
ARG BUILD_VERSION
WORKDIR /src
COPY ["Web/Resgrid.Web.Mcp/Resgrid.Web.Mcp.csproj", "Web/Resgrid.Web.Mcp/"]
Expand Down Expand Up @@ -35,13 +37,11 @@ WORKDIR "/src/Web/Resgrid.Web.Mcp"
FROM build AS publish
ARG BUILD_VERSION
RUN dotnet publish "Resgrid.Web.Mcp.csproj" -c Release -o /app/publish -p:Version=${BUILD_VERSION}
ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait /app/publish/wait
RUN chmod +x /app/publish/wait

FROM base AS final
## Add the wait script to the image
ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait wait
RUN chmod +x wait

WORKDIR /app
COPY --from=publish /app/publish .

ENTRYPOINT ["sh", "-c", "./wait && dotnet Resgrid.Web.Mcp.dll"]
ENTRYPOINT ["./wait"]
CMD ["dotnet", "Resgrid.Web.Mcp.dll"]
15 changes: 8 additions & 7 deletions Web/Resgrid.Web.Services/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,14 @@

ARG BUILD_VERSION=3.5.0

FROM mcr.microsoft.com/dotnet/aspnet:9.0.3-noble-amd64 AS base
#FROM mcr.microsoft.com/dotnet/runtime:9.0.3-noble-amd64 AS base
FROM dhi.io/dotnet:9.0.16-debian13 AS base
ARG BUILD_VERSION
WORKDIR /app
EXPOSE 80

FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
#FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
FROM dhi.io/dotnet:9.0.314-sdk-debian13 AS build
ARG BUILD_VERSION
WORKDIR /src
COPY ["Web/Resgrid.Web.Services/Resgrid.Web.Services.csproj", "Web/Resgrid.Web.Services/"]
Expand Down Expand Up @@ -35,12 +37,11 @@ WORKDIR "/src/Web/Resgrid.Web.Services"
FROM build AS publish
ARG BUILD_VERSION
RUN dotnet publish "Resgrid.Web.Services.csproj" -c Release -o /app/publish -p:Version=${BUILD_VERSION}
ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait /app/publish/wait
RUN chmod +x /app/publish/wait

FROM base AS final
## Add the wait script to the image
ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait wait
RUN chmod +x wait

WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["sh", "-c", "./wait && dotnet Resgrid.Web.Services.dll"]
ENTRYPOINT ["./wait"]
CMD ["dotnet", "Resgrid.Web.Services.dll"]
8 changes: 5 additions & 3 deletions Web/Resgrid.Web.Tts/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,13 @@
ARG BUILD_VERSION=3.5.0

FROM mcr.microsoft.com/dotnet/aspnet:9.0.3-noble-amd64 AS base
#FROM mcr.microsoft.com/dotnet/runtime:9.0.3-noble-amd64 AS base
FROM dhi.io/dotnet:9.0.16-debian13 AS base
ARG BUILD_VERSION
WORKDIR /app
EXPOSE 8080

FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
#FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
FROM dhi.io/dotnet:9.0.314-sdk-debian13 AS build
ARG BUILD_VERSION
WORKDIR /src

Expand Down Expand Up @@ -64,4 +66,4 @@ COPY --from=build /app/publish .

ENV ASPNETCORE_URLS=http://+:8080
USER appuser
ENTRYPOINT ["dotnet", "Resgrid.Web.Tts.dll"]
ENTRYPOINT ["dotnet", "Resgrid.Web.Tts.dll"]
16 changes: 9 additions & 7 deletions Web/Resgrid.Web/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,15 @@
#See https://aka.ms/containerfastmode to understand how Visual Studio uses this Dockerfile to build your images for faster debugging.
ARG BUILD_VERSION=3.5.0

FROM mcr.microsoft.com/dotnet/aspnet:9.0.3-noble-amd64 AS base
#FROM mcr.microsoft.com/dotnet/aspnet:9.0.3-noble-amd64 AS base
FROM dhi.io/aspnetcore:9.0.16-debian13 AS base
ARG BUILD_VERSION
WORKDIR /app
EXPOSE 80

#FROM node:18.19-alpine3.19 AS node_base
FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
#FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
FROM dhi.io/dotnet:9.0.314-sdk-debian13 AS build
#RUN apt-get update && apt-get install nodejs
#COPY --from=node_base . .
#COPY --from=node_base /usr/lib /usr/lib
Expand Down Expand Up @@ -52,12 +54,12 @@ ENV PATH="${PATH}:/root/.dotnet/tools"
RUN for i in 1 2 3; do libman restore && break || { echo "libman restore attempt $i failed, retrying..."; sleep 10; }; done
ENV SKIP_LIBMAN_RESTORE=1
RUN dotnet publish "Resgrid.Web.csproj" -c Release -o /app/publish -p:Version=${BUILD_VERSION}
## Download the wait script in the build stage where a shell is available
ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait /app/publish/wait
RUN chmod +x /app/publish/wait

FROM base AS final
## Add the wait script to the image
ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait wait
RUN chmod +x wait

WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["sh", "-c", "./wait && dotnet Resgrid.Web.dll"]
ENTRYPOINT ["./wait"]
CMD ["dotnet", "Resgrid.Web.dll"]
14 changes: 8 additions & 6 deletions Workers/Resgrid.Workers.Console/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,13 @@
#See https://aka.ms/containerfastmode to understand how Visual Studio uses this Dockerfile to build your images for faster debugging.
ARG BUILD_VERSION=3.5.0

FROM mcr.microsoft.com/dotnet/runtime:9.0.3-noble-amd64 AS base
#FROM mcr.microsoft.com/dotnet/runtime:9.0.3-noble-amd64 AS base
FROM dhi.io/dotnet:9.0.16-debian13 AS base
ARG BUILD_VERSION
WORKDIR /app

FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
#FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
FROM dhi.io/dotnet:9.0.314-sdk-debian13 AS build
Comment on lines +5 to +10
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the distro/package mismatch in this Dockerfile.
rg -n '^\s*FROM\s+dhi\.io/dotnet:.*debian13' Workers/Resgrid.Workers.Console/Dockerfile
rg -n 'wkhtmltox_.*jammy_amd64\.deb' Workers/Resgrid.Workers.Console/Dockerfile

# Expected: both patterns match -> mismatch confirmed.
# Follow-up: use a Debian-compatible wkhtmltopdf package/build path.

Repository: Resgrid/Core

Length of output: 331

Replace the Ubuntu Jammy-specific wkhtmltopdf package with a Debian 13-compatible version.

The migration to Debian 13 base images (lines 5, 10) is incompatible with the Ubuntu Jammy-specific wkhtmltopdf package (lines 48, 57: wkhtmltox_0.12.6.1-3.jammy_amd64.deb). This distro mismatch can cause dependency resolution failures or runtime breakage due to libc and library incompatibilities between Debian 13 and Ubuntu Jammy.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Workers/Resgrid.Workers.Console/Dockerfile` around lines 5 - 10, The
Dockerfile uses Debian 13 base images (e.g., FROM
dhi.io/dotnet:9.0.314-sdk-debian13 AS build) but still installs an Ubuntu
Jammy-specific package (wkhtmltox_0.12.6.1-3.jammy_amd64.deb); replace that
Jammy .deb with a Debian 13-compatible wkhtmltopdf package or installation
method: either download the appropriate Debian 13/trixie .deb from wkhtmltopdf
releases, install wkhtmltopdf from Debian repositories via apt, or build/install
from source/official static binary, and update the Dockerfile to reference the
correct package filename and installation commands so dependencies match the
Debian 13 base image.

ARG BUILD_VERSION
WORKDIR /src

Expand Down Expand Up @@ -35,11 +37,10 @@ WORKDIR "/src/Workers/Resgrid.Workers.Console"
FROM build AS publish
ARG BUILD_VERSION
RUN dotnet publish "Resgrid.Workers.Console.csproj" -c Release -o /app/publish -p:Version=${BUILD_VERSION}
ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait /app/publish/wait
RUN chmod +x /app/publish/wait

FROM base AS final
## Add the wait script to the image
ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.9.0/wait wait
RUN chmod +x wait

WORKDIR /app

Expand All @@ -65,4 +66,5 @@ RUN set -xe \

COPY --from=publish /app/publish .

ENTRYPOINT ["sh", "-c", "./wait && dotnet Resgrid.Workers.Console.dll"]
ENTRYPOINT ["./wait"]
CMD ["dotnet", "Resgrid.Workers.Console.dll"]
Loading