dotnet-runtime 9.0.121

Each tag is a multi-arch index (amd64 + arm64) pinned by digest. Tagged by version, never :latest.

Use it as a base image

Reference it in the FROM line of your Dockerfile. Nonroot, read-only root filesystem, built for amd64 and arm64.

FROM ghcr.io/quenchworks/images/dotnet-runtime:9.0.121

Or pull it directly

docker pull ghcr.io/quenchworks/images/dotnet-runtime:9.0.121

Version line

9.0.121

Latest line

10.0.112, 9.0.121

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

License

MIT

Verify the supply chain

This image is cosign-signed and carries an SPDX SBOM and a SLSA build-provenance attestation on the same digest. Check all three before you build on it:

# 1. signature — built and signed by QuenchWorks CI
cosign verify ghcr.io/quenchworks/images/dotnet-runtime:9.0.121 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. SLSA build provenance — which workflow built it, from what
cosign verify-attestation --type https://slsa.dev/provenance/v1 ghcr.io/quenchworks/images/dotnet-runtime:9.0.121 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 3. SPDX SBOM — the package inventory
cosign verify-attestation --type https://spdx.dev/Document/v2.3 ghcr.io/quenchworks/images/dotnet-runtime:9.0.121 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

See the SBOM & provenance guide for reading the SBOM and using these checks in CI.

Best-practice Dockerfile for 9.0.121

dotnet-runtime is a runtime base you copy a published console or worker app onto, not something you build in. Here dotnet publish runs in an SDK build stage and the dotnet-runtime image is the final stage that runs it.

1
# Build stage: restore and publish the worker/console app with the SDK.
2
FROM ghcr.io/quenchworks/images/dotnet:10.0.112 AS build
3
USER root
4
WORKDIR /src
5
ENV NUGET_PACKAGES=/tmp/nuget \
6
    DOTNET_CLI_TELEMETRY_OPTOUT=1
7

8
COPY ["Worker.csproj", "./"]
9
RUN ["dotnet", "restore", "Worker.csproj"]
10
COPY . .
11
RUN ["dotnet", "publish", "Worker.csproj", "-c", "Release", "-o", "/app/publish", "--no-restore"]
12

13
# This image is the final runtime stage: the plain .NET runtime, nonroot.
14
FROM ghcr.io/quenchworks/images/dotnet-runtime:9.0.121 AS runtime
15
WORKDIR /app
16
COPY --from=build /app/publish ./
17
USER 1001
18
ENTRYPOINT ["dotnet", "Worker.dll"]

This Dockerfile is pinned to the 9.0.121 line. For the line-by-line walkthrough and ecosystem variants (npm/Yarn, pip/uv/Poetry, Maven/Gradle), see the Build a .NET appguide.