Dotnet-docker: Run as non-root user in samples

[nphmuller]

Since it's considered a best practice to run a container as a non-root user, could you extend the samples to do this? Or maybe there is even a way to do this from the base images.

[richlander]

Good suggestion. Doing this would cause us to have platform-specific Dockerfiles. We already offer multiple Dockerfiles for other reasons, like unit testing or not. We'd have to provide multiple versions of these Dockerfiles to account for this request. We think the benefit for non-root in our samples isn't high enough to warrant doubling the Dockerfile count, both for us as the maintainers and all the readers would read them.

[gfoidl]

Maybe it's enough to add a comment in the Dockerfiles that points out to use a non-root user in production.

[richlander]

That feels like documentation that should be added to our markdown instructions. Maybe we should create a "Best Practices" document that we link to from various places. ??

[gfoidl]

create a "Best Practices" document

For "Best practices" I would stick to Best practices for writing Dockerfiles | Docker Documentation. A new one would be in essence a duplication of that one, and might confuse readers when there a different best practices around.

we link to from various places.

This would be nice 👍

[richlander]

Makes sense to me. Feel free to PR that link into various places here. Otherwise, I'll do it on my next update of our samples.

[nphmuller]

@richlander The action of adding the user is platform specific, but the USER Docker instruction isn't, right?
Maybe a good approach would be the one that the official Node.js docker images use. They create the user in the base image (for dotnet this would probably be the runtime images).

This way the samples could still be the same for all platforms. They would simply contain the USER dotnet instruction, which already exists because of the base image.

[nphmuller]

On second thought. Wouldn't it be even better if the USER instruction was part of the base image? If that works, I wonder why not more base images do this.

[RehanSaeed]

Was this ever done. I'm trying to find some guidance on this subject.