Improve running .NET in containers as a non-root user

[MichaelSimons]

Improve running .NET in containers as a non-root user

We see an increasing number of requests from users seeking guidance on running containers as non-root users. A primary driver for running as non-root is related to reducing vulnerabilities. This issue discusses why we don't define a non-root user within the .NET images. This issues explores and tracks ways we can enhance .NET to better support running in containers as a non-root user.

.NET Docker

• Include documentation and samples that demonstrate USER best practices

Runtime

• Kestrel does not support running as non-root on Alpine

[ChrisHanna]

Hi @MichaelSimons, we are running into this exact issue where the base image is getting flagged during vulnerability scans. I understand, our reasoning behind not defining a non-root user for our base images. However, in our case developers cannot add the base image to an enterprise container registry without first passing the scan. So they are required to get an exception, and state that they will define the non root user in their docker file. The other option is for them to create their own image from the netcore 3.1 base image, and define a non root user before putting it in their container registry. Is it a possibility to provide both a root 3.1 base image and a non-root base image or provide a little more direction in our documentation.

[biltongza]

+1 to this, mounting a volume causes things to be written to as root which can cause some headaches if you aren't expecting it.

[IvanJosipovic]

There was some guidance posted recently here, https://techcommunity.microsoft.com/t5/azure-developer-community-blog/hardening-an-asp-net-container-running-on-kubernetes/ba-p/2542224

[olljanat]

IMO it would make sense to default to non-root user starting from some new version release (e.g. .NET 6.0 or .NET 7.0) and highlight that on release notes.

[olljanat]

FYI. I started working on this on PR #3139