Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use ASPNETCORE_HTTP_PORTS and set APP_UID. #472

Merged
merged 1 commit into from
Oct 9, 2023
Merged

Use ASPNETCORE_HTTP_PORTS and set APP_UID. #472

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions 8.0/build/Dockerfile.rhel8
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,13 +59,13 @@ RUN /usr/libexec/s2i/container-tool build-tool
# directories (such as ~/.pki/nssdb) there. These will be owned by root and can
# cause actions that work on all of /opt/app-root to fail. So we need to fix
# the permissions on those too.
RUN chown -R 1001:0 /opt/app-root && fix-permissions /opt/app-root
RUN chown -R $APP_UID:0 /opt/app-root && fix-permissions /opt/app-root

# Needed for the `dotnet watch` to detect changes in a container
ENV DOTNET_USE_POLLING_FILE_WATCHER=true

# Run container by default as user with id 1001 (default)
USER 1001
# Run container rootless.
USER $APP_UID

# Set the default CMD to start a shell.
CMD /bin/bash
5 changes: 2 additions & 3 deletions 8.0/build/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,10 +155,9 @@ a `.s2i/environment` file inside your source code repository.
`Release` or `Debug`. This is passed to the `dotnet publish` invocation.
Defaults to `Release`.

* **ASPNETCORE_URLS**
* **ASPNETCORE_HTTP_PORTS**

This variable is set to `http://*:8080` to configure ASP.NET Core to use the
port exposed by the image.
This variable is set to `8080` to configure ASP.NET Core to use the port exposed by the image.

* **HTTP_PROXY, HTTPS_PROXY**

Expand Down
25 changes: 12 additions & 13 deletions 8.0/runtime/Dockerfile.rhel8
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,15 @@ ENV HOME=/opt/app-root \
DOTNET_DEFAULT_CMD=default-cmd.sh \
DOTNET_CORE_VERSION=8.0 \
DOTNET_FRAMEWORK=net8.0 \
# Microsoft's images set this to enable detecting when an app is running in a container.
# Microsoft's images set this to enable detecting when an app is running in a container.
DOTNET_RUNNING_IN_CONTAINER=true \
DOTNET_SSL_CERT_DIR=/opt/app-root/ssl_dir
DOTNET_SSL_CERT_DIR=/opt/app-root/ssl_dir \
# Don't download/extract docs for nuget packages
NUGET_XMLDOC_MODE=skip \
# Configure ASP.NET Core to use the exposed port
ASPNETCORE_HTTP_PORTS=8080 \
# Like Microsoft images, set APP_UID to the UID of the non-root user.
APP_UID=1001

LABEL io.k8s.description="Platform for running .NET 8 applications" \
io.k8s.display-name=".NET 8" \
Expand All @@ -32,13 +38,6 @@ LABEL name="ubi8/dotnet-80-runtime" \
version="8.0" \
release="1"

# Don't download/extract docs for nuget packages
ENV NUGET_XMLDOC_MODE=skip

## By default, ASP.NET Core runs on port 5000. We configure it to match
## the container port.
ENV ASPNETCORE_URLS=http://*:8080

# Each language image can have 'contrib' a directory with extra files needed to
# run and build the applications.
COPY ./contrib/ /opt/app-root
Expand Down Expand Up @@ -73,7 +72,7 @@ RUN [ -z "${DOTNET_TARBALL}" ] || ( \

# Add default user
RUN mkdir -p ${DOTNET_APP_PATH} ${DOTNET_DATA_PATH} && \
useradd -u 1001 -r -g 0 -d ${HOME} -s /sbin/nologin \
useradd -u $APP_UID -r -g 0 -d ${HOME} -s /sbin/nologin \
-c "Default Application User" default

WORKDIR ${DOTNET_APP_PATH}
Expand All @@ -83,9 +82,9 @@ CMD "./${DOTNET_DEFAULT_CMD}"
# In order to drop the root user, we have to make some directories world
# writable as OpenShift default security model is to run the container under
# random UID.
RUN chown -R 1001:0 /opt/app-root && fix-permissions /opt/app-root
RUN chown -R $APP_UID:0 /opt/app-root && fix-permissions /opt/app-root

ENTRYPOINT [ "container-entrypoint" ]

# Run container by default as user with id 1001 (default)
USER 1001
# Run container rootless.
USER $APP_UID
11 changes: 8 additions & 3 deletions 8.0/runtime/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,10 +69,9 @@ Environment variables
The following variables are set so they can be used from scripts.
They must not to be overridden.

* **ASPNETCORE_URLS**
* **ASPNETCORE_HTTP_PORTS**

This variable is set to `http://*:8080` to configure ASP.NET Core to use the
port exposed by the image.
This variable is set to `8080` to configure ASP.NET Core to use the port exposed by the image.

* **DOTNET_APP_PATH,DOTNET_DEFAULT_CMD,DOTNET_DATA_PATH**

Expand All @@ -92,3 +91,9 @@ They must not to be overridden.
* **DOTNET_RUNNING_IN_CONTAINER**

Like Microsoft images, this is set to `true` and can be used to detect the application is built/running in a container.

* **APP_UID**

Like Microsoft images, this is set to the rootless user's uid to enable switching to that user
in a Dockerfile using the the instruction: `USER $APP_UID`.
.
22 changes: 5 additions & 17 deletions 8.0/runtime/test/aspnet-hello-world/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,6 @@
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Http;
var builder = WebApplication.CreateBuilder(args);
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The ASPNETCORE_HTTP_PORTS was introduced in a backwards compatible way.

It seems the backwards compatibility does not include the old WebHost API which this example was still using.
I've created an issue: dotnet/aspnetcore#51125.
We should follow what comes out.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like introducing a non-breaking change when it is not needed,
though I prefer to follow what Microsoft does here, and document the breaking change.

If Microsoft makes some further changes to avoid the breaking change, we can sync again for those.

var app = builder.Build();

namespace AspNetHelloWorld
{
public class Program
{
public static void Main(string[] args)
{
new WebHostBuilder()
.UseKestrel()
.Configure(a => a.Run(c => c.Response.WriteAsync("Hello World!")))
.Build()
.Run();
}
}
}
app.MapGet("/", () => "Hello World!");

app.Run();
Binary file modified 8.0/runtime/test/aspnet-hello-world/app.tar.gz
View file
Open in desktop
Binary file not shown.
1 change: 1 addition & 0 deletions 8.0/runtime/test/aspnet-hello-world/aspnet-hello-world.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
<Project Sdk="Microsoft.NET.Sdk.Web">
<PropertyGroup>
<TargetFramework>net8.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
</PropertyGroup>
</Project>
9 changes: 6 additions & 3 deletions 8.0/runtime/test/run
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,8 +117,11 @@ test_timezones() {
test_user() {
test_start

# we run as user 'default'
# we run as user 'default' which has a uid of 1001.
assert_equal $(docker_run $IMAGE_NAME "whoami") "default"
assert_equal $(docker_run $IMAGE_NAME "id -u") "1001"
# APP_UID is set to match the uid of the default user.
assert_equal $(docker_get_env $IMAGE_NAME APP_UID) "1001"
# root is 'root'
assert_equal $(docker_run_as $IMAGE_NAME 0 "whoami") "root"
}
Expand All @@ -128,8 +131,8 @@ test_port() {

# Port 8080 is exposed
assert_equal $(docker_get_exposedports $IMAGE_NAME) '{"8080/tcp":{}}'
# The environment variable used by ASP.NET Core matches
assert_equal $(docker_get_env $IMAGE_NAME ASPNETCORE_URLS) "http://*:8080"
# The environment variable used by ASP.NET Core matches the exposed port.
assert_equal $(docker_get_env $IMAGE_NAME ASPNETCORE_HTTP_PORTS) "8080"
}

verify_aspnet_image_works() {
Expand Down