Docker

codewithmukesh/dotnet-claude-kit/skills/docker

作者 codewithmukesh23300897f4d1无许可证754 个星标收录于 2026年10月8日更新于 2026年10月8日仓库2个月前更新

Docker containerization for .NET 10 applications. Covers multi-stage builds, .NET container images, non-root user configuration, health checks, and .dockerignore. Load this skill when containerizing an application with a Dockerfile, optimizing image size, setting up Docker Compose for local development, or when the user mentions "Docker", "Dockerfile", "container", "docker-compose", "image", "multi-stage", "non-root", ".dockerignore", or "container health check". For Dockerfile-less SDK publishing (`dotnet publish /t:PublishContainer`), load the container-publish skill instead.

仅含说明DevOps & Cloud

AI 生成的概览

为 .NET 10 应用提供 Docker 容器化指导：多阶段 Dockerfile、非 root 用户、健康探测与 Compose。

功能: 该技能为使用 Docker 容器化 .NET 10 应用提供参考指导。内容涵盖多阶段 Dockerfile 模式、.NET SDK 与 ASP.NET 运行时镜像、非 root 用户配置、用于 NuGet 还原的层缓存、.dockerignore 内容、健康探测方式，以及用于本地开发的 Docker Compose。它还列出了反模式，例如在运行时使用 SDK 镜像、在还原前复制源码，以及以 root 身份运行。
适用场景: 在为 .NET 应用编写或审查 Dockerfile、优化镜像大小、搭建本地开发用 Docker Compose，或配置容器健康检查时使用。当用户提到 Docker、Dockerfile、container、docker-compose、multi-stage、non-root、.dockerignore 或容器健康检查时也适用。
运行要求: 该技能不附带脚本或资源，仅为说明性指令。按其示例操作需要 Docker、.NET 10 SDK 与 ASP.NET 运行时镜像，若使用编排层健康探测还需 Docker Compose 或 Kubernetes。

Docker

Core Principles

Multi-stage builds always — Separate build and runtime stages. Build in the SDK image, run in the ASP.NET runtime image.
Non-root by default — .NET container images support USER app by default since .NET 8. Never run as root in production.
Layer caching matters — Copy .csproj files and restore before copying source code. This caches NuGet dependencies across builds.
Health probes at the orchestrator level — Expose a /health/live endpoint and let Kubernetes/Compose probe it. Chiseled and default aspnet images have no shell or curl, so in-image HEALTHCHECK commands have nothing to run with.

Patterns

Multi-Stage Dockerfile for Web API

dockerfile

# Stage 1: BuildFROM mcr.microsoft.com/dotnet/sdk:10.0 AS buildWORKDIR /src
# Copy project files and restore (cached layer)COPY ["src/MyApp.Api/MyApp.Api.csproj", "src/MyApp.Api/"]COPY ["src/MyApp.Domain/MyApp.Domain.csproj", "src/MyApp.Domain/"]COPY ["Directory.Build.props", "."]COPY ["Directory.Packages.props", "."]RUN dotnet restore "src/MyApp.Api/MyApp.Api.csproj"
# Copy everything and buildCOPY . .RUN dotnet publish "src/MyApp.Api/MyApp.Api.csproj" \    -c Release \    -o /app/publish \    --no-restore
# Stage 2: RuntimeFROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtimeWORKDIR /app
# Non-root user (default in .NET 8+ images)USER app
COPY --from=build /app/publish .
EXPOSE 8080
ENTRYPOINT ["dotnet", "MyApp.Api.dll"]

# Stage 1: BuildFROM mcr.microsoft.com/dotnet/sdk:10.0 AS buildWORKDIR /src
# Copy project files and restore (cached layer)COPY ["src/MyApp.Api/MyApp.Api.csproj", "src/MyApp.Api/"]COPY ["src/MyApp.Domain/MyApp.Domain.csproj", "src/MyApp.Domain/"]COPY ["Directory.Build.props", "."]COPY ["Directory.Packages.props", "."]RUN dotnet restore "src/MyApp.Api/MyApp.Api.csproj"
# Copy everything and buildCOPY . .RUN dotnet publish "src/MyApp.Api/MyApp.Api.csproj" \    -c Release \    -o /app/publish \    --no-restore
# Stage 2: RuntimeFROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtimeWORKDIR /app
# Non-root user (default in .NET 8+ images)USER app
COPY --from=build /app/publish .
EXPOSE 8080
ENTRYPOINT ["dotnet", "MyApp.Api.dll"]

Container Health Probes

Prefer orchestrator-level probes (Kubernetes livenessProbe, Compose healthcheck) over a Dockerfile HEALTHCHECK — the standard aspnet and chiseled images ship no shell, no curl, and no wget, so there is nothing inside the container to run the probe with. Point the orchestrator at /health/live:

yaml

# docker-compose — probe from outside the app processservices:  api:    healthcheck:      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health/live || exit 1"]      interval: 30s      timeout: 3s      retries: 3# Note: CMD-SHELL requires a shell + wget in the image. Use a non-chiseled# variant for this, or better: let Kubernetes httpGet probes do it —# they run from the kubelet, needing nothing inside the image.

# docker-compose — probe from outside the app processservices:  api:    healthcheck:      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health/live || exit 1"]      interval: 30s      timeout: 3s      retries: 3# Note: CMD-SHELL requires a shell + wget in the image. Use a non-chiseled# variant for this, or better: let Kubernetes httpGet probes do it —# they run from the kubelet, needing nothing inside the image.

If you must have an in-image HEALTHCHECK, base the runtime stage on a non-chiseled image that includes wget — never re-run the app binary as the probe command; that starts a second instance instead of checking the first.

.dockerignore

Docker Compose for Local Development

Key .NET-specific concerns — pass connection strings via environment, use depends_on with health checks:

yaml

services:  api:    build:      context: .      dockerfile: src/MyApp.Api/Dockerfile    ports:      - "5000:8080"    environment:      - ASPNETCORE_ENVIRONMENT=Development      - ConnectionStrings__Default=Host=postgres;Database=myapp;Username=postgres;Password=postgres      - ConnectionStrings__Redis=redis:6379    depends_on:      postgres:        condition: service_healthy  # Add postgres/redis services with healthcheck — standard boilerplate

services:  api:    build:      context: .      dockerfile: src/MyApp.Api/Dockerfile    ports:      - "5000:8080"    environment:      - ASPNETCORE_ENVIRONMENT=Development      - ConnectionStrings__Default=Host=postgres;Database=myapp;Username=postgres;Password=postgres      - ConnectionStrings__Redis=redis:6379    depends_on:      postgres:        condition: service_healthy  # Add postgres/redis services with healthcheck — standard boilerplate

Optimized Build with .slnx

For solutions with multiple projects, restore only the necessary projects.

dockerfile

FROM mcr.microsoft.com/dotnet/sdk:10.0 AS buildWORKDIR /src
# Copy solution and all project filesCOPY *.slnx .COPY Directory.Build.props .COPY Directory.Packages.props .COPY src/**/*.csproj ./src/
# Restore project structureRUN for file in src/**/*.csproj; do \    mkdir -p $(dirname $file) && mv $file $(dirname $file)/; \    doneRUN dotnet restore
COPY . .RUN dotnet publish src/MyApp.Api -c Release -o /app/publish --no-restore

FROM mcr.microsoft.com/dotnet/sdk:10.0 AS buildWORKDIR /src
# Copy solution and all project filesCOPY *.slnx .COPY Directory.Build.props .COPY Directory.Packages.props .COPY src/**/*.csproj ./src/
# Restore project structureRUN for file in src/**/*.csproj; do \    mkdir -p $(dirname $file) && mv $file $(dirname $file)/; \    doneRUN dotnet restore
COPY . .RUN dotnet publish src/MyApp.Api -c Release -o /app/publish --no-restore

Health Check Endpoint

csharp

// In Program.cs — lightweight health endpoint for Dockerapp.MapGet("/health/live", () => Results.Ok("healthy"))    .ExcludeFromDescription();

// In Program.cs — lightweight health endpoint for Dockerapp.MapGet("/health/live", () => Results.Ok("healthy"))    .ExcludeFromDescription();

Anti-patterns

Don't Use SDK Image for Runtime

dockerfile

# BAD — SDK image is 900MB+, includes compilersFROM mcr.microsoft.com/dotnet/sdk:10.0COPY . .RUN dotnet run
# GOOD — separate build and runtime, runtime image is ~200MBFROM mcr.microsoft.com/dotnet/aspnet:10.0

# BAD — SDK image is 900MB+, includes compilersFROM mcr.microsoft.com/dotnet/sdk:10.0COPY . .RUN dotnet run
# GOOD — separate build and runtime, runtime image is ~200MBFROM mcr.microsoft.com/dotnet/aspnet:10.0

Don't Copy Everything Before Restore

dockerfile

# BAD — any source change invalidates the NuGet cacheCOPY . .RUN dotnet restore
# GOOD — copy only project files first, then restoreCOPY ["src/MyApp.Api/MyApp.Api.csproj", "src/MyApp.Api/"]RUN dotnet restore "src/MyApp.Api/MyApp.Api.csproj"COPY . .

# BAD — any source change invalidates the NuGet cacheCOPY . .RUN dotnet restore
# GOOD — copy only project files first, then restoreCOPY ["src/MyApp.Api/MyApp.Api.csproj", "src/MyApp.Api/"]RUN dotnet restore "src/MyApp.Api/MyApp.Api.csproj"COPY . .

Don't Run as Root

dockerfile

# BAD — running as root (security risk)FROM mcr.microsoft.com/dotnet/aspnet:10.0COPY --from=build /app .ENTRYPOINT ["dotnet", "MyApp.Api.dll"]
# GOOD — use the built-in non-root userFROM mcr.microsoft.com/dotnet/aspnet:10.0USER appCOPY --from=build /app .ENTRYPOINT ["dotnet", "MyApp.Api.dll"]

# BAD — running as root (security risk)FROM mcr.microsoft.com/dotnet/aspnet:10.0COPY --from=build /app .ENTRYPOINT ["dotnet", "MyApp.Api.dll"]
# GOOD — use the built-in non-root userFROM mcr.microsoft.com/dotnet/aspnet:10.0USER appCOPY --from=build /app .ENTRYPOINT ["dotnet", "MyApp.Api.dll"]

Decision Guide

Scenario	Recommendation
Web API container	Multi-stage build with aspnet runtime image
Worker service	Multi-stage build with dotnet/runtime image
Local development	Docker Compose with service dependencies
CI builds	Multi-stage build (self-contained)
Image size optimization	Use Alpine variant + trimming for small images
Health monitoring	`/health` endpoint + orchestrator probe (K8s `httpGet` / Compose healthcheck)
Secrets	Environment variables or mounted secrets, never in image

来源与署名

来源：codewithmukesh/dotnet-claude-kit位于skills/docker提交2330089

许可证：无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Docker

Docker

Core Principles

Patterns

Multi-Stage Dockerfile for Web API

Container Health Probes

.dockerignore

Docker Compose for Local Development

Optimized Build with .slnx

Health Check Endpoint

Anti-patterns

Don't Use SDK Image for Runtime

Don't Copy Everything Before Restore

Don't Run as Root

Decision Guide

来源与署名

更多来自 codewithmukesh/dotnet-claude-kit 的技能

Wrap Up

Workflow Mastery

Vertical Slice

Testing

Tdd

Spec

更多DevOps & Cloud技能

Playwright Devops

M5 Onboard

Yeet

Runbook

Incident Response

Deploy Checklist