Container Publish

codewithmukesh/dotnet-claude-kit/skills/container-publish

作者 codewithmukesh23300897f4d1無授權條款754 個星標收錄於 2026年10月8日更新於 2026年10月8日儲存庫2 個月前更新

Dockerfile-less containerization using the .NET 10 SDK container publishing feature. Covers MSBuild properties, chiseled images, multi-arch builds, and registry publishing — all without writing a Dockerfile. Load this skill when the user wants to containerize without a Dockerfile, or mentions "dotnet publish container", "PublishContainer", "ContainerRepository", "ContainerFamily", "chiseled", "distroless", "container publish", "SDK container", "no Dockerfile", or "containerize without Docker".

僅含說明DevOps & Cloud

AI 產生的概覽

使用 .NET 10 SDK 容器發佈功能，不需 Dockerfile 即可將 .NET 應用程式容器化。

功能: 說明如何直接透過 dotnet publish /t:PublishContainer 建置符合 OCI 規範的容器映像，而不必撰寫 Dockerfile。內容涵蓋 ContainerRepository、ContainerFamily、ContainerPort 等 MSBuild 容器屬性、chiseled 與 distroless 基礎映像變體、多架構建置、多重標籤、tar 封裝輸出，以及推送至 ghcr.io、Azure Container Registry 和 Docker Hub 等登錄檔。此外也列出反模式，並提供在 SDK 發佈與 Dockerfile 之間取捨的決策指南。
適用情境: 適用於在不撰寫 Dockerfile 的情況下將 .NET 應用程式容器化，或使用者提到 dotnet publish container、PublishContainer、ContainerRepository、ContainerFamily、chiseled、distroless 或 containerize without Docker 時。也適合在 CI 中設定多架構映像建置或登錄檔推送。不適用於 SDK 無法發佈的工作負載，例如 Azure Functions 或需要原生作業系統套件的映像。
執行需求: 不附帶指令碼，僅為說明文件。需要 .NET 10 SDK，以及用於本機映像輸出與推送的 Docker 守護程序或登錄檔存取權限。推送至登錄檔前須先完成身分驗證，例如 docker login、az acr login 或 CI 權杖；使用 tar 封裝輸出則不需要容器執行階段。

Container Publishing (No Dockerfile)

Core Principles

No Dockerfile needed — The .NET 10 SDK builds OCI-compliant container images directly from dotnet publish /t:PublishContainer. No Dockerfile to write or maintain.
Chiseled images for production — Use noble-chiseled base images: no shell, no package manager, 7 Linux components vs 100+. Smallest attack surface.
Non-root by default — .NET 10 container images run as the app user automatically. Never override to root in production.
Configuration in the .csproj — All container settings are MSBuild properties, versioned with your project. No separate files to drift.

Patterns

Minimal Container Publish

No project file changes needed. Just publish:

This creates a container image in your local Docker daemon using the default aspnet:10.0 base image.

Production-Ready .csproj Configuration

xml

<Project Sdk="Microsoft.NET.Sdk.Web">
  <PropertyGroup>    <TargetFramework>net10.0</TargetFramework>    <ContainerRepository>mycompany/myapp-api</ContainerRepository>    <ContainerFamily>noble-chiseled</ContainerFamily>  </PropertyGroup>
  <ItemGroup>    <ContainerPort Include="8080" Type="tcp" />    <ContainerEnvironmentVariable Include="ASPNETCORE_HTTP_PORTS" Value="8080" />    <ContainerEnvironmentVariable Include="DOTNET_EnableDiagnostics" Value="0" />    <ContainerLabel Include="org.opencontainers.image.vendor" Value="MyCompany" />  </ItemGroup>
</Project>

<Project Sdk="Microsoft.NET.Sdk.Web">
  <PropertyGroup>    <TargetFramework>net10.0</TargetFramework>    <ContainerRepository>mycompany/myapp-api</ContainerRepository>    <ContainerFamily>noble-chiseled</ContainerFamily>  </PropertyGroup>
  <ItemGroup>    <ContainerPort Include="8080" Type="tcp" />    <ContainerEnvironmentVariable Include="ASPNETCORE_HTTP_PORTS" Value="8080" />    <ContainerEnvironmentVariable Include="DOTNET_EnableDiagnostics" Value="0" />    <ContainerLabel Include="org.opencontainers.image.vendor" Value="MyCompany" />  </ItemGroup>
</Project>

Publishing to a Registry

Authenticate with docker login first, then specify the registry:

bash

# GitHub Container Registrydocker login ghcr.iodotnet publish /t:PublishContainer --os linux --arch x64 \    -p ContainerRegistry=ghcr.io \    -p ContainerImageTag=1.0.0
# Azure Container Registryaz acr login --name myregistrydotnet publish /t:PublishContainer --os linux --arch x64 \    -p ContainerRegistry=myregistry.azurecr.io
# Docker Hub (requires username prefix in repository)dotnet publish /t:PublishContainer --os linux --arch x64 \    -p ContainerRegistry=docker.io \    -p ContainerRepository=myuser/myapp

# GitHub Container Registrydocker login ghcr.iodotnet publish /t:PublishContainer --os linux --arch x64 \    -p ContainerRegistry=ghcr.io \    -p ContainerImageTag=1.0.0
# Azure Container Registryaz acr login --name myregistrydotnet publish /t:PublishContainer --os linux --arch x64 \    -p ContainerRegistry=myregistry.azurecr.io
# Docker Hub (requires username prefix in repository)dotnet publish /t:PublishContainer --os linux --arch x64 \    -p ContainerRegistry=docker.io \    -p ContainerRepository=myuser/myapp

Multi-Architecture Images

Build images for multiple platforms with a single publish:

xml

<PropertyGroup>    <RuntimeIdentifiers>linux-x64;linux-arm64</RuntimeIdentifiers>    <ContainerRuntimeIdentifiers>linux-x64;linux-arm64</ContainerRuntimeIdentifiers></PropertyGroup>

<PropertyGroup>    <RuntimeIdentifiers>linux-x64;linux-arm64</RuntimeIdentifiers>    <ContainerRuntimeIdentifiers>linux-x64;linux-arm64</ContainerRuntimeIdentifiers></PropertyGroup>

This produces an OCI Image Index — registries serve the correct architecture automatically.

Multiple Tags

bash

# Bash — note the quoting for semicolonsdotnet publish /t:PublishContainer --os linux --arch x64 \    -p ContainerImageTags='"1.0.0;latest"'

# Bash — note the quoting for semicolonsdotnet publish /t:PublishContainer --os linux --arch x64 \    -p ContainerImageTags='"1.0.0;latest"'

Or in the project file:

Save as Tarball (No Docker Required)

No container runtime needed on the build machine. Useful for CI scanning:

bash

dotnet publish /t:PublishContainer --os linux --arch x64 \    -p ContainerArchiveOutputPath=./images/myapp.tar.gz
# Scan with Trivy before pushingtrivy image --input ./images/myapp.tar.gz

dotnet publish /t:PublishContainer --os linux --arch x64 \    -p ContainerArchiveOutputPath=./images/myapp.tar.gz
# Scan with Trivy before pushingtrivy image --input ./images/myapp.tar.gz

Chiseled Image Variants

ContainerFamily	Use Case	Shell	Size
(default)	General purpose (Debian)	Yes	~220 MB
`noble-chiseled`	Production (no shell)	No	~110 MB
`noble-chiseled-extra`	Production with localization (ICU)	No	~120 MB
`alpine`	Small size, has shell	Yes	~112 MB

xml

<!-- Standard chiseled (InvariantGlobalization=true) --><ContainerFamily>noble-chiseled</ContainerFamily>
<!-- Chiseled with ICU for localization --><ContainerFamily>noble-chiseled-extra</ContainerFamily>

<!-- Standard chiseled (InvariantGlobalization=true) --><ContainerFamily>noble-chiseled</ContainerFamily>
<!-- Chiseled with ICU for localization --><ContainerFamily>noble-chiseled-extra</ContainerFamily>

For Native AOT, the SDK auto-selects chiseled-aot:

CI/CD with GitHub Actions

yaml

jobs:  publish:    runs-on: ubuntu-latest    permissions:      packages: write    steps:      - uses: actions/checkout@v5      - uses: actions/setup-dotnet@v5        with:          dotnet-version: '10.0.x'      - uses: docker/login-action@v3        with:          registry: ghcr.io          username: ${{ github.actor }}          password: ${{ secrets.GITHUB_TOKEN }}      - run: |          dotnet publish src/MyApp.Api/MyApp.Api.csproj \            /t:PublishContainer --os linux --arch x64 \            -p ContainerRegistry=ghcr.io \            -p ContainerRepository=${{ github.repository_owner }}/myapp \            -p ContainerImageTag=${{ github.sha }}

jobs:  publish:    runs-on: ubuntu-latest    permissions:      packages: write    steps:      - uses: actions/checkout@v5      - uses: actions/setup-dotnet@v5        with:          dotnet-version: '10.0.x'      - uses: docker/login-action@v3        with:          registry: ghcr.io          username: ${{ github.actor }}          password: ${{ secrets.GITHUB_TOKEN }}      - run: |          dotnet publish src/MyApp.Api/MyApp.Api.csproj \            /t:PublishContainer --os linux --arch x64 \            -p ContainerRegistry=ghcr.io \            -p ContainerRepository=${{ github.repository_owner }}/myapp \            -p ContainerImageTag=${{ github.sha }}

Anti-patterns

Don't Use the Deprecated Property Names

xml

<!-- BAD — ContainerImageName is deprecated --><ContainerImageName>myapp</ContainerImageName>
<!-- GOOD — use ContainerRepository --><ContainerRepository>myapp</ContainerRepository>

<!-- BAD — ContainerImageName is deprecated --><ContainerImageName>myapp</ContainerImageName>
<!-- GOOD — use ContainerRepository --><ContainerRepository>myapp</ContainerRepository>

Don't Use PublishProfile=DefaultContainer

bash

# BAD — old approach, inconsistent across project typesdotnet publish -p:PublishProfile=DefaultContainer
# GOOD — use the MSBuild target directlydotnet publish /t:PublishContainer

# BAD — old approach, inconsistent across project typesdotnet publish -p:PublishProfile=DefaultContainer
# GOOD — use the MSBuild target directlydotnet publish /t:PublishContainer

Don't Forget to Target Linux

bash

# BAD on Windows — may produce a Windows containerdotnet publish /t:PublishContainer
# GOOD — explicitly target Linuxdotnet publish /t:PublishContainer --os linux --arch x64

# BAD on Windows — may produce a Windows containerdotnet publish /t:PublishContainer
# GOOD — explicitly target Linuxdotnet publish /t:PublishContainer --os linux --arch x64

Don't Skip Authentication Before Push

bash

# BAD — fails with CONTAINER1013 errordotnet publish /t:PublishContainer -p ContainerRegistry=ghcr.io
# GOOD — authenticate firstdocker login ghcr.iodotnet publish /t:PublishContainer -p ContainerRegistry=ghcr.io

# BAD — fails with CONTAINER1013 errordotnet publish /t:PublishContainer -p ContainerRegistry=ghcr.io
# GOOD — authenticate firstdocker login ghcr.iodotnet publish /t:PublishContainer -p ContainerRegistry=ghcr.io

Don't Use SDK Publishing When You Need OS Packages

xml

<!-- BAD — SDK container publish cannot run apt-get or install native packages --><!-- There is no RUN equivalent -->
<!-- GOOD — create a custom base image with a Dockerfile first, then reference it --><ContainerBaseImage>myregistry/custom-base:1.0</ContainerBaseImage>

<!-- BAD — SDK container publish cannot run apt-get or install native packages --><!-- There is no RUN equivalent -->
<!-- GOOD — create a custom base image with a Dockerfile first, then reference it --><ContainerBaseImage>myregistry/custom-base:1.0</ContainerBaseImage>

Decision Guide

Scenario	Recommendation
Standard ASP.NET Core API	SDK container publishing with `noble-chiseled`
Worker service / console app	SDK container publishing (native .NET 10 support)
Needs native OS packages	Dockerfile (or custom base image + SDK publishing)
Azure Functions	Dockerfile (not supported by SDK publishing)
CI without Docker daemon	Tarball output with `ContainerArchiveOutputPath`
Multi-arch deployment (x64 + arm64)	`ContainerRuntimeIdentifiers` property
Production image size	`noble-chiseled` (~110 MB) or Native AOT (~10 MB)
Local development	`dotnet publish /t:PublishContainer --os linux --arch x64`
Registry push	`ContainerRegistry` + `docker login`

來源與署名

來源：codewithmukesh/dotnet-claude-kit位於skills/container-publish提交2330089

授權條款：無授權條款

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

Container Publish

Container Publishing (No Dockerfile)

Core Principles

Patterns

Minimal Container Publish

Production-Ready .csproj Configuration

Publishing to a Registry

Multi-Architecture Images

Multiple Tags

Save as Tarball (No Docker Required)

Chiseled Image Variants

CI/CD with GitHub Actions

Anti-patterns

Don't Use the Deprecated Property Names

Don't Use PublishProfile=DefaultContainer

Don't Forget to Target Linux

Don't Skip Authentication Before Push

Don't Use SDK Publishing When You Need OS Packages

Decision Guide

來源與署名

更多來自 codewithmukesh/dotnet-claude-kit 的技能

Wrap Up

Workflow Mastery

Vertical Slice

Testing

Tdd

Spec

更多DevOps & Cloud技能

Playwright Devops

M5 Onboard

Yeet

Runbook

Incident Response

Deploy Checklist