Add non-root user support

README.runtime-deps.md

@@ -60,9 +60,9 @@ Tags | Dockerfile | OS Version
 Tags | Dockerfile | OS Version
 -----------| -------------| -------------
 8.0.0-preview.1-bookworm-slim-amd64, 8.0-preview-bookworm-slim-amd64, 8.0.0-preview.1, 8.0.0-preview.1-bookworm-slim, 8.0-preview, 8.0-preview-bookworm-slim, latest | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/8.0/bookworm-slim/amd64/Dockerfile) | Debian 12
-8.0.0-preview.1-alpine3.17-amd64, 8.0-preview-alpine3.17-amd64, 8.0-preview-alpine-amd64, 8.0.0-preview.1-alpine3.17, 8.0-preview-alpine3.17, 8.0-preview-alpine | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/6.0/alpine3.17/amd64/Dockerfile) | Alpine 3.17
-8.0.0-preview.1-jammy-amd64, 8.0-preview-jammy-amd64, 8.0.0-preview.1-jammy, 8.0-preview-jammy | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/6.0/jammy/amd64/Dockerfile) | Ubuntu 22.04
-8.0.0-preview.1-jammy-chiseled-amd64, 8.0-preview-jammy-chiseled-amd64, 8.0.0-preview.1-jammy-chiseled, 8.0-preview-jammy-chiseled | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/6.0/jammy-chiseled/amd64/Dockerfile) | Ubuntu 22.04
+8.0.0-preview.1-alpine3.17-amd64, 8.0-preview-alpine3.17-amd64, 8.0-preview-alpine-amd64, 8.0.0-preview.1-alpine3.17, 8.0-preview-alpine3.17, 8.0-preview-alpine | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/8.0/alpine3.17/amd64/Dockerfile) | Alpine 3.17
+8.0.0-preview.1-jammy-amd64, 8.0-preview-jammy-amd64, 8.0.0-preview.1-jammy, 8.0-preview-jammy | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/8.0/jammy/amd64/Dockerfile) | Ubuntu 22.04
+8.0.0-preview.1-jammy-chiseled-amd64, 8.0-preview-jammy-chiseled-amd64, 8.0.0-preview.1-jammy-chiseled, 8.0-preview-jammy-chiseled | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/8.0/jammy-chiseled/amd64/Dockerfile) | Ubuntu 22.04
 
 ## Linux arm64 Tags
 Tags | Dockerfile | OS Version
@@ -83,9 +83,9 @@ Tags | Dockerfile | OS Version
 Tags | Dockerfile | OS Version
 -----------| -------------| -------------
 8.0.0-preview.1-bookworm-slim-arm64v8, 8.0-preview-bookworm-slim-arm64v8, 8.0.0-preview.1, 8.0.0-preview.1-bookworm-slim, 8.0-preview, 8.0-preview-bookworm-slim, latest | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/8.0/bookworm-slim/arm64v8/Dockerfile) | Debian 12
-8.0.0-preview.1-alpine3.17-arm64v8, 8.0-preview-alpine3.17-arm64v8, 8.0-preview-alpine-arm64v8, 8.0.0-preview.1-alpine3.17, 8.0-preview-alpine3.17, 8.0-preview-alpine | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/6.0/alpine3.17/arm64v8/Dockerfile) | Alpine 3.17
-8.0.0-preview.1-jammy-arm64v8, 8.0-preview-jammy-arm64v8, 8.0.0-preview.1-jammy, 8.0-preview-jammy | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/6.0/jammy/arm64v8/Dockerfile) | Ubuntu 22.04
-8.0.0-preview.1-jammy-chiseled-arm64v8, 8.0-preview-jammy-chiseled-arm64v8, 8.0.0-preview.1-jammy-chiseled, 8.0-preview-jammy-chiseled | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/6.0/jammy-chiseled/arm64v8/Dockerfile) | Ubuntu 22.04
+8.0.0-preview.1-alpine3.17-arm64v8, 8.0-preview-alpine3.17-arm64v8, 8.0-preview-alpine-arm64v8, 8.0.0-preview.1-alpine3.17, 8.0-preview-alpine3.17, 8.0-preview-alpine | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/8.0/alpine3.17/arm64v8/Dockerfile) | Alpine 3.17
+8.0.0-preview.1-jammy-arm64v8, 8.0-preview-jammy-arm64v8, 8.0.0-preview.1-jammy, 8.0-preview-jammy | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/8.0/jammy/arm64v8/Dockerfile) | Ubuntu 22.04
+8.0.0-preview.1-jammy-chiseled-arm64v8, 8.0-preview-jammy-chiseled-arm64v8, 8.0.0-preview.1-jammy-chiseled, 8.0-preview-jammy-chiseled | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/8.0/jammy-chiseled/arm64v8/Dockerfile) | Ubuntu 22.04
 
 ## Linux arm32 Tags
 Tags | Dockerfile | OS Version
@@ -104,8 +104,8 @@ Tags | Dockerfile | OS Version
 Tags | Dockerfile | OS Version
 -----------| -------------| -------------
 8.0.0-preview.1-bookworm-slim-arm32v7, 8.0-preview-bookworm-slim-arm32v7, 8.0.0-preview.1, 8.0.0-preview.1-bookworm-slim, 8.0-preview, 8.0-preview-bookworm-slim, latest | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/8.0/bookworm-slim/arm32v7/Dockerfile) | Debian 12
-8.0.0-preview.1-alpine3.17-arm32v7, 8.0-preview-alpine3.17-arm32v7, 8.0-preview-alpine-arm32v7, 8.0.0-preview.1-alpine3.17, 8.0-preview-alpine3.17, 8.0-preview-alpine | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/6.0/alpine3.17/arm32v7/Dockerfile) | Alpine 3.17
-8.0.0-preview.1-jammy-arm32v7, 8.0-preview-jammy-arm32v7, 8.0.0-preview.1-jammy, 8.0-preview-jammy | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/6.0/jammy/arm32v7/Dockerfile) | Ubuntu 22.04
+8.0.0-preview.1-alpine3.17-arm32v7, 8.0-preview-alpine3.17-arm32v7, 8.0-preview-alpine-arm32v7, 8.0.0-preview.1-alpine3.17, 8.0-preview-alpine3.17, 8.0-preview-alpine | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/8.0/alpine3.17/arm32v7/Dockerfile) | Alpine 3.17
+8.0.0-preview.1-jammy-arm32v7, 8.0-preview-jammy-arm32v7, 8.0.0-preview.1-jammy, 8.0-preview-jammy | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/nightly/src/runtime-deps/8.0/jammy/arm32v7/Dockerfile) | Ubuntu 22.04
 
 You can retrieve a list of all available tags for dotnet/nightly/runtime-deps at https://mcr.microsoft.com/v2/dotnet/nightly/runtime-deps/tags/list.
 <!--End of generated tags-->

eng/dockerfile-templates/Dockerfile.common-dotnet-envs

@@ -5,10 +5,12 @@
     set isMariner to find(OS_VERSION, "cbl-mariner") >= 0 ^
     set isDistroless to find(OS_VERSION, "distroless") >= 0 || find(OS_VERSION, "chiseled") >= 0 ^
     set lineContinuation to when(isWindows, "`", "\") ^
-    set port to when(isDistroless, "8080", "80")
+    set port to when(isDistroless, "8080", "80") ^
+    set httpPort to "8080"
 }}ENV {{lineContinuation}}
-    # Configure web servers to bind to port {{port}} when present
-    ASPNETCORE_URLS=http://+:{{port}} {{lineContinuation}}
+    {{if dotnetVersion != "8.0":# Configure web servers to bind to port {{port}} when present
+    ASPNETCORE_URLS=http://+:{{port}} {{lineContinuation}}^else:# Configure web servers to bind to port {{httpPort}} when present
+    ASPNETCORE_HTTP_PORTS={{httpPort}} {{lineContinuation}}}}
     {{InsertTemplate("Dockerfile.env.container")}}{{if isAlpine || (isDistroless && !(isMariner && find(OS_VERSION, "1.0") > 0)): {{lineContinuation}}
     # Set the invariant mode since ICU package isn't included (see https://github.com/dotnet/announcements/issues/20)
     DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=true}}

eng/dockerfile-templates/Dockerfile.linux.install-deps

@@ -27,15 +27,26 @@
                     "openssl-libs",
                     "zlib"
                 ],
+                when(dotnetVersion = "8.0",
                 [
                     "glibc",
                     "icu",
                     "krb5",
                     "libgcc",
                     "libstdc++",
                     "openssl-libs",
+                    "shadow-utils",
                     "zlib"
-                ]),
+                ],
+                [
+                    "glibc",
+                    "icu",
+                    "krb5",
+                    "libgcc",
+                    "libstdc++",
+                    "openssl-libs",
+                    "zlib"
+                ])),
             [
                 "libc6",
                 "libgcc1",

eng/dockerfile-templates/runtime-deps/Dockerfile

@@ -19,7 +19,10 @@
     set isRpmInstall to isMariner && dotnetVersion = "6.0" ^
     set isSingleStage to !(isRpmInstall && isInternal) ^
     set urlSuffix to when(isInternal, "$SAS_QUERY_STRING", "") ^
-    set rpmFilename to "dotnet-runtime-deps.rpm"
+    set rpmFilename to "dotnet-runtime-deps.rpm" ^
+    set username to "app" ^
+    set uid to 101 ^
+    set gid to uid
 }}{{
     if !isSingleStage:# Installer image
 }}FROM {{baseImageRepo}}:{{baseImageTag}}{{if !isSingleStage: AS installer}}{{ if isInternal && isRpmInstall:
@@ -52,5 +55,16 @@ RUN {{InsertTemplate("../Dockerfile.linux.install-deps")}}
         "url-suffix": urlSuffix,
         "filename": rpmFilename
     ])}}
+}}{{if dotnetVersion = "8.0":
+# Create a non-root user and group
+RUN {{InsertTemplate("Dockerfile.linux.non-root-user",
+        [
+            "staging-dir": distrolessStagingDir,
+            "exclusive": "false",
+            "name": username,
+            "uid": uid,
+            "gid": gid,
+            "create-home": "false"
+        ],"    ")}}
 }}
 {{InsertTemplate("../Dockerfile.common-dotnet-envs")}}

eng/dockerfile-templates/runtime-deps/Dockerfile.chiseled-ubuntu

@@ -16,17 +16,15 @@ FROM {{ARCH_VERSIONED}}/ubuntu:{{osVersionBase}} as builder
 RUN apt-get update && \
     apt-get install -y ca-certificates
 
-RUN {{InsertTemplate("Dockerfile.linux.distroless-user",
-    [
+{{InsertTemplate("Dockerfile.linux.distroless-user", [
         "staging-dir": "/rootfs",
         "exclusive": "true",
         "create-dir": "true",
         "name": username,
         "uid": uid,
         "gid": gid,
         "create-home": "true"
-    ],
-    "    ")}}
+    ])}}
 
 COPY --from=chisel /opt/chisel/chisel /usr/bin/
 RUN chisel cut --release "ubuntu-{{osVersionNumber}}" --root /rootfs \

eng/dockerfile-templates/runtime-deps/Dockerfile.distroless-mariner

@@ -33,16 +33,15 @@ RUN tmpManifestPath="/tmp/rpmmanifest" \
 
 }}
 # Create a non-root user and group
-RUN {{InsertTemplate("Dockerfile.linux.distroless-user",
+{{InsertTemplate("Dockerfile.linux.distroless-user",
         [
             "staging-dir": distrolessStagingDir,
             "exclusive": dotnetVersion != "6.0",
             "name": username,
             "uid": uid,
             "gid": gid,
             "create-home": createUserHome
-        ],
-        "    ")}}
+        ])}}
 
 # Clean up staging
 RUN rm -rf {{distrolessStagingDir}}/etc/{{when(find(OS_VERSION, "1.0") >= 0, "dnf", "tdnf")}} \

eng/dockerfile-templates/runtime-deps/Dockerfile.linux.distroless-user

@@ -9,26 +9,22 @@
         gid: ID of the group to be created
         create-home (optional): Indicates whether a home directory should be created for the user ^
     set dotnetVersion to join(slice(split(PRODUCT_VERSION, "."), 0, 2), ".") ^
-    set isMariner to find(OS_VERSION, "cbl-mariner") >= 0
-}}groupadd \
-    --system \
-    --gid={{ARGS["gid"]}} \
-    {{ARGS["name"]}} \
-&& adduser \
-    --uid {{ARGS["uid"]}} \
-    --gid {{ARGS["gid"]}} \
-    --shell /bin/false \{{if !ARGS["create-home"]:
-    --no-create-home \}}
-    --system \
-    {{ARGS["name"]}} \{{
-if ARGS["create-home"]:
-&& install -d -m 0755 -o {{ARGS["uid"]}} -g {{ARGS["gid"]}} "{{ARGS["staging-dir"]}}/home/{{ARGS["name"]}}" \}}{{
-if ARGS["exclusive"]:{{if ARGS["create-dir"]:
-&& mkdir -p "{{ARGS["staging-dir"]}}/etc" \}}
-&& rootOrAppRegex='@^\(root\|app\):' \
-&& cat /etc/passwd | grep $rootOrAppRegex > "{{ARGS["staging-dir"]}}/etc/passwd" \
-&& cat /etc/group | grep $rootOrAppRegex > "{{ARGS["staging-dir"]}}/etc/group"^
-else:
-# Copy user/group info to staging
-&& cp /etc/passwd {{ARGS["staging-dir"]}}/etc/passwd \
-&& cp /etc/group {{ARGS["staging-dir"]}}/etc/group}}
+    set isMariner to find(OS_VERSION, "cbl-mariner") >= 0 ^
+    set isAlpine to find(OS_VERSION, "alpine") >= 0
+}}RUN {{InsertTemplate("Dockerfile.linux.non-root-user",
+[
+    "name": ARGS["name"],
+    "uid": ARGS["uid"],
+    "gid": ARGS["gid"],
+    "create-home": ARGS[["create-home"]]
+],"    ")}} \{{if ARGS["create-home"]:
+    && install -d -m 0755 -o {{ARGS["uid"]}} -g {{ARGS["gid"]}} "{{ARGS["staging-dir"]}}/home/{{ARGS["name"]}}" \}}{{
+    if ARGS["exclusive"]:{{if ARGS["create-dir"]:
+    && mkdir -p "{{ARGS["staging-dir"]}}/etc" \}}
+    && rootOrAppRegex='@^\(root\|app\):' \
+    && cat /etc/passwd | grep $rootOrAppRegex > "{{ARGS["staging-dir"]}}/etc/passwd" \
+    && cat /etc/group | grep $rootOrAppRegex > "{{ARGS["staging-dir"]}}/etc/group"^
+    else:
+    # Copy user/group info to staging
+    && cp /etc/passwd {{ARGS["staging-dir"]}}/etc/passwd \
+    && cp /etc/group {{ARGS["staging-dir"]}}/etc/group}}

eng/dockerfile-templates/runtime-deps/Dockerfile.linux.non-root-user

@@ -0,0 +1,22 @@
+{{
+    _ Configures a non-root user
+    _ ARGS:
+        name: Name of the user/group to create
+        uid: ID of the user to be created
+        gid: ID of the group to be created
+        create-home (optional): Indicates whether a home directory should be created for the user ^
+    set dotnetVersion to join(slice(split(PRODUCT_VERSION, "."), 0, 2), ".") ^
+    set isAlpine to find(OS_VERSION, "alpine") >= 0 ^
+    set isDebian to find(OS_ARCH_HYPHENATED, "Debian") >= 0 ^
+    set isMariner to find(OS_VERSION, "cbl-mariner") >= 0
+}}{{if isAlpine:addgroup^else:groupadd}} \
+    --system \
+    --gid {{ARGS["gid"]}} \
+    {{ARGS["name"]}} \
+&& {{if isDebian:useradd^else:adduser}} \
+    --uid {{ARGS["uid"]}} \
+    {{if isAlpine:--ingroup {{ARGS["name"]}}^else:--gid {{ARGS["gid"]}}}} \
+    --shell /bin/false \
+    --system \{{if !ARGS["create-home"]:
+    --no-create-home \}}
+    {{ARGS["name"]}}

eng/dockerfile-templates/sdk/Dockerfile.envs

@@ -3,9 +3,9 @@
     set isAlpine to find(OS_VERSION, "alpine") >= 0 ^
     set isWindows to find(OS_VERSION, "nanoserver") >= 0 || find(OS_VERSION, "windowsservercore") >= 0 ^
     set lineContinuation to when(isWindows, "`", "\")
-}}ENV {{lineContinuation}}
+}}ENV {{lineContinuation}}{{if dotnetVersion != "8.0":
     # Unset ASPNETCORE_URLS from aspnet base image
-    ASPNETCORE_URLS= {{lineContinuation}}
+    ASPNETCORE_URLS= {{lineContinuation}}}}
     # Do not generate certificate
     DOTNET_GENERATE_ASPNET_CERTIFICATE=false {{lineContinuation}}
     # Do not show first run text

eng/dockerfile-templates/sdk/Dockerfile.linux.first-run

@@ -1,6 +1,7 @@
 {{
     _ ARGS
-        append-cmd: Indicates whether to append the command to an existing command
+        append-cmd: Indicates whether to append the command to an existing command ^
 
+    set dotnetVersion to join(slice(split(PRODUCT_VERSION, "."), 0, 2), ".")
 }}# Trigger first run experience by running arbitrary cmd
 {{if ARGS["append-cmd"]:&&^else:RUN}} dotnet help

manifest.json

@@ -888,7 +888,7 @@
           },
           "platforms": [
             {
-              "dockerfile": "src/runtime-deps/6.0/alpine3.17/amd64",
+              "dockerfile": "src/runtime-deps/8.0/alpine3.17/amd64",
               "dockerfileTemplate": "eng/dockerfile-templates/runtime-deps/Dockerfile",
               "os": "linux",
               "osVersion": "alpine3.17",
@@ -900,7 +900,7 @@
             },
             {
               "architecture": "arm",
-              "dockerfile": "src/runtime-deps/6.0/alpine3.17/arm32v7",
+              "dockerfile": "src/runtime-deps/8.0/alpine3.17/arm32v7",
               "dockerfileTemplate": "eng/dockerfile-templates/runtime-deps/Dockerfile",
               "os": "linux",
               "osVersion": "alpine3.17",
@@ -913,7 +913,7 @@
             },
             {
               "architecture": "arm64",
-              "dockerfile": "src/runtime-deps/6.0/alpine3.17/arm64v8",
+              "dockerfile": "src/runtime-deps/8.0/alpine3.17/arm64v8",
               "dockerfileTemplate": "eng/dockerfile-templates/runtime-deps/Dockerfile",
               "os": "linux",
               "osVersion": "alpine3.17",
@@ -934,7 +934,7 @@
           },
           "platforms": [
             {
-              "dockerfile": "src/runtime-deps/6.0/jammy/amd64",
+              "dockerfile": "src/runtime-deps/8.0/jammy/amd64",
               "dockerfileTemplate": "eng/dockerfile-templates/runtime-deps/Dockerfile",
               "os": "linux",
               "osVersion": "jammy",
@@ -945,7 +945,7 @@
             },
             {
               "architecture": "arm",
-              "dockerfile": "src/runtime-deps/6.0/jammy/arm32v7",
+              "dockerfile": "src/runtime-deps/8.0/jammy/arm32v7",
               "dockerfileTemplate": "eng/dockerfile-templates/runtime-deps/Dockerfile",
               "os": "linux",
               "osVersion": "jammy",
@@ -957,7 +957,7 @@
             },
             {
               "architecture": "arm64",
-              "dockerfile": "src/runtime-deps/6.0/jammy/arm64v8",
+              "dockerfile": "src/runtime-deps/8.0/jammy/arm64v8",
               "dockerfileTemplate": "eng/dockerfile-templates/runtime-deps/Dockerfile",
               "os": "linux",
               "osVersion": "jammy",
@@ -977,7 +977,7 @@
           },
           "platforms": [
             {
-              "dockerfile": "src/runtime-deps/6.0/jammy-chiseled/amd64",
+              "dockerfile": "src/runtime-deps/8.0/jammy-chiseled/amd64",
               "dockerfileTemplate": "eng/dockerfile-templates/runtime-deps/Dockerfile.chiseled-ubuntu",
               "os": "linux",
               "osVersion": "jammy-chiseled",
@@ -997,7 +997,7 @@
             },
             {
               "architecture": "arm64",
-              "dockerfile": "src/runtime-deps/6.0/jammy-chiseled/arm64v8",
+              "dockerfile": "src/runtime-deps/8.0/jammy-chiseled/arm64v8",
               "dockerfileTemplate": "eng/dockerfile-templates/runtime-deps/Dockerfile.chiseled-ubuntu",
               "os": "linux",
               "osVersion": "jammy-chiseled",
@@ -1033,7 +1033,7 @@
           },
           "platforms": [
             {
-              "dockerfile": "src/runtime-deps/7.0/cbl-mariner2.0/amd64",
+              "dockerfile": "src/runtime-deps/8.0/cbl-mariner2.0/amd64",
               "dockerfileTemplate": "eng/dockerfile-templates/runtime-deps/Dockerfile",
               "os": "linux",
               "osVersion": "cbl-mariner2.0",
@@ -1051,7 +1051,7 @@
             },
             {
               "architecture": "arm64",
-              "dockerfile": "src/runtime-deps/7.0/cbl-mariner2.0/arm64v8",
+              "dockerfile": "src/runtime-deps/8.0/cbl-mariner2.0/arm64v8",
               "dockerfileTemplate": "eng/dockerfile-templates/runtime-deps/Dockerfile",
               "os": "linux",
               "osVersion": "cbl-mariner2.0",
@@ -1085,7 +1085,7 @@
           },
           "platforms": [
             {
-              "dockerfile": "src/runtime-deps/7.0/cbl-mariner2.0-distroless/amd64",
+              "dockerfile": "src/runtime-deps/8.0/cbl-mariner2.0-distroless/amd64",
               "dockerfileTemplate": "eng/dockerfile-templates/runtime-deps/Dockerfile.distroless-mariner",
               "os": "linux",
               "osVersion": "cbl-mariner2.0-distroless",
@@ -1112,7 +1112,7 @@
             },
             {
               "architecture": "arm64",
-              "dockerfile": "src/runtime-deps/7.0/cbl-mariner2.0-distroless/arm64v8",
+              "dockerfile": "src/runtime-deps/8.0/cbl-mariner2.0-distroless/arm64v8",
               "dockerfileTemplate": "eng/dockerfile-templates/runtime-deps/Dockerfile.distroless-mariner",
               "os": "linux",
               "osVersion": "cbl-mariner2.0-distroless",

samples/aspnetapp/Dockerfile

@@ -1,5 +1,5 @@
 # https://hub.docker.com/_/microsoft-dotnet
-FROM mcr.microsoft.com/dotnet/sdk:7.0 AS build
+FROM nonroot-aspnet as build
 WORKDIR /source
 
 # copy csproj and restore as distinct layers
@@ -11,7 +11,7 @@ COPY aspnetapp/. .
 RUN dotnet publish -c Release -o /app --use-current-runtime --self-contained false --no-restore
 
 # final stage/image
-FROM mcr.microsoft.com/dotnet/aspnet:7.0
+FROM nonroot-aspnet
 WORKDIR /app
 COPY --from=build /app .
 ENTRYPOINT ["dotnet", "aspnetapp.dll"]

src/runtime-deps/6.0/cbl-mariner1.0-distroless/amd64/Dockerfile

@@ -23,14 +23,14 @@ RUN mkdir /staging \
 # Create a non-root user and group
 RUN groupadd \
         --system \
-        --gid=1000 \
+        --gid 1000 \
         app \
     && adduser \
         --uid 1000 \
         --gid 1000 \
         --shell /bin/false \
-        --no-create-home \
         --system \
+        --no-create-home \
         app \
     # Copy user/group info to staging
     && cp /etc/passwd /staging/etc/passwd \

src/runtime-deps/6.0/cbl-mariner2.0-distroless/amd64/Dockerfile

@@ -32,14 +32,14 @@ RUN tmpManifestPath="/tmp/rpmmanifest" \
 # Create a non-root user and group
 RUN groupadd \
         --system \
-        --gid=101 \
+        --gid 101 \
         app \
     && adduser \
         --uid 101 \
         --gid 101 \
         --shell /bin/false \
-        --no-create-home \
         --system \
+        --no-create-home \
         app \
     # Copy user/group info to staging
     && cp /etc/passwd /staging/etc/passwd \