Skip to content

RE1-T119 Migrating to Docker Hardened Images#380

Merged
ucswift merged 2 commits into
masterfrom
develop
May 14, 2026
Merged

RE1-T119 Migrating to Docker Hardened Images#380
ucswift merged 2 commits into
masterfrom
develop

Conversation

@ucswift
Copy link
Copy Markdown
Member

@ucswift ucswift commented May 13, 2026

Summary by CodeRabbit

  • Chores

    • Switched container base and build images from the previous distributor to dhi.io/dotnet across multiple services.
    • Removed one repository's Dockerfile content.
  • Refactor

    • Moved the startup wait helper into the publish artifact, made it executable, and changed containers to use exec-form ENTRYPOINT plus CMD for startup.
    • Updated a PDF tool package to a newer distribution release.

Review Change Stack

@request-info
Copy link
Copy Markdown

request-info Bot commented May 13, 2026

Thanks for opening this, but we'd appreciate a little more information. Could you update it with more details?

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 13, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 325d3f94-ab1e-4f51-80d5-bcb4b88fa5bb

📥 Commits

Reviewing files that changed from the base of the PR and between cfe98de and 81f7167.

📒 Files selected for processing (7)
  • Repositories/Resgrid.Repositories.DataRepository/Dockerfile
  • Web/Resgrid.Web.Eventing/Dockerfile
  • Web/Resgrid.Web.Mcp/Dockerfile
  • Web/Resgrid.Web.Services/Dockerfile
  • Web/Resgrid.Web.Tts/Dockerfile
  • Web/Resgrid.Web/Dockerfile
  • Workers/Resgrid.Workers.Console/Dockerfile
💤 Files with no reviewable changes (1)
  • Repositories/Resgrid.Repositories.DataRepository/Dockerfile
🚧 Files skipped from review as they are similar to previous changes (6)
  • Web/Resgrid.Web.Tts/Dockerfile
  • Web/Resgrid.Web/Dockerfile
  • Web/Resgrid.Web.Mcp/Dockerfile
  • Web/Resgrid.Web.Services/Dockerfile
  • Web/Resgrid.Web.Eventing/Dockerfile
  • Workers/Resgrid.Workers.Console/Dockerfile

📝 Walkthrough

Walkthrough

All six containerized services update base/build images to dhi.io/dotnet; docker-compose-wait is moved into publish output and images switch from shell-chained wait execution to ENTRYPOINT ["./wait"] with CMD to run each .NET assembly. One Dockerfile was cleared.

Changes

Docker image and startup pattern migration

Layer / File(s) Summary
Base and build image migration to dhi.io
Web/Resgrid.Web.Eventing/Dockerfile, Web/Resgrid.Web.Mcp/Dockerfile, Web/Resgrid.Web.Services/Dockerfile, Web/Resgrid.Web.Tts/Dockerfile, Web/Resgrid.Web/Dockerfile, Workers/Resgrid.Workers.Console/Dockerfile
Replace mcr.microsoft.com/dotnet runtime and SDK images with dhi.io/dotnet equivalents (pinned tags/digests) in base and build stages.
Wait script placement and startup refactor
Web/Resgrid.Web.Eventing/Dockerfile, Web/Resgrid.Web.Mcp/Dockerfile, Web/Resgrid.Web.Services/Dockerfile, Web/Resgrid.Web.Tts/Dockerfile, Web/Resgrid.Web/Dockerfile, Workers/Resgrid.Workers.Console/Dockerfile
Move docker-compose-wait into the publish stage at /app/publish/wait (chmod +x), copy it into final images, and change startup from sh -c "./wait && dotnet ..." to ENTRYPOINT ["./wait"] with CMD ["dotnet","App.dll"].
Workers: wkhtmltopdf package and startup adjustments
Workers/Resgrid.Workers.Console/Dockerfile
Update WKHTMLTOX to the bookworm_amd64 deb and adjust RUN install/cleanup; ensure wait script is added in publish and switch to exec-form ENTRYPOINT ["./wait"] with CMD ["dotnet","Resgrid.Workers.Console.dll"].
Remove DataRepository Dockerfile contents
Repositories/Resgrid.Repositories.DataRepository/Dockerfile
The Dockerfile was cleared; previous build/runtime directives and CMD ./entrypoint.sh were removed.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

  • Resgrid/Core#340: Both PRs modify Web/Resgrid.Web.Tts/Dockerfile to change the Docker build/runtime base stages and related image/tag usage.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title 'RE1-T119 Migrating to Docker Hardened Images' clearly and specifically identifies the main change: migrating Dockerfiles to use hardened Docker images (dhi.io/dotnet) instead of standard Microsoft images across multiple services.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch develop

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Web/Resgrid.Web.Eventing/Dockerfile`:
- Around line 5-11: Replace all dhi.io image tags used in FROM statements with
immutable digest pins (use the `@sha256`:<digest> form) so builds are
reproducible; specifically update each occurrence of images like
dhi.io/dotnet:9.0.16-debian13 and dhi.io/dotnet:9.0.314-sdk-debian13 (and any
other dhi.io/* references) to their corresponding sha256 digests in the
Dockerfile FROM lines, ensuring both the runtime and sdk images are pinned
across all six migrated Dockerfiles.

In `@Workers/Resgrid.Workers.Console/Dockerfile`:
- Around line 5-10: The Dockerfile uses Debian 13 base images (e.g., FROM
dhi.io/dotnet:9.0.314-sdk-debian13 AS build) but still installs an Ubuntu
Jammy-specific package (wkhtmltox_0.12.6.1-3.jammy_amd64.deb); replace that
Jammy .deb with a Debian 13-compatible wkhtmltopdf package or installation
method: either download the appropriate Debian 13/trixie .deb from wkhtmltopdf
releases, install wkhtmltopdf from Debian repositories via apt, or build/install
from source/official static binary, and update the Dockerfile to reference the
correct package filename and installation commands so dependencies match the
Debian 13 base image.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a9637143-e160-4c58-8daf-c2954cbe6fea

📥 Commits

Reviewing files that changed from the base of the PR and between aff8f96 and cfe98de.

📒 Files selected for processing (6)
  • Web/Resgrid.Web.Eventing/Dockerfile
  • Web/Resgrid.Web.Mcp/Dockerfile
  • Web/Resgrid.Web.Services/Dockerfile
  • Web/Resgrid.Web.Tts/Dockerfile
  • Web/Resgrid.Web/Dockerfile
  • Workers/Resgrid.Workers.Console/Dockerfile

Comment thread Web/Resgrid.Web.Eventing/Dockerfile Outdated
Comment on lines +5 to +10
FROM dhi.io/dotnet:9.0.16-debian13 AS base
ARG BUILD_VERSION
WORKDIR /app

FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
#FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble-amd64 AS build
FROM dhi.io/dotnet:9.0.314-sdk-debian13 AS build
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the distro/package mismatch in this Dockerfile.
rg -n '^\s*FROM\s+dhi\.io/dotnet:.*debian13' Workers/Resgrid.Workers.Console/Dockerfile
rg -n 'wkhtmltox_.*jammy_amd64\.deb' Workers/Resgrid.Workers.Console/Dockerfile

# Expected: both patterns match -> mismatch confirmed.
# Follow-up: use a Debian-compatible wkhtmltopdf package/build path.

Repository: Resgrid/Core

Length of output: 331


Replace the Ubuntu Jammy-specific wkhtmltopdf package with a Debian 13-compatible version.

The migration to Debian 13 base images (lines 5, 10) is incompatible with the Ubuntu Jammy-specific wkhtmltopdf package (lines 48, 57: wkhtmltox_0.12.6.1-3.jammy_amd64.deb). This distro mismatch can cause dependency resolution failures or runtime breakage due to libc and library incompatibilities between Debian 13 and Ubuntu Jammy.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Workers/Resgrid.Workers.Console/Dockerfile` around lines 5 - 10, The
Dockerfile uses Debian 13 base images (e.g., FROM
dhi.io/dotnet:9.0.314-sdk-debian13 AS build) but still installs an Ubuntu
Jammy-specific package (wkhtmltox_0.12.6.1-3.jammy_amd64.deb); replace that
Jammy .deb with a Debian 13-compatible wkhtmltopdf package or installation
method: either download the appropriate Debian 13/trixie .deb from wkhtmltopdf
releases, install wkhtmltopdf from Debian repositories via apt, or build/install
from source/official static binary, and update the Dockerfile to reference the
correct package filename and installation commands so dependencies match the
Debian 13 base image.

@ucswift
Copy link
Copy Markdown
Member Author

ucswift commented May 14, 2026

Approve

Copy link
Copy Markdown

@github-actions github-actions Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR is approved.

@ucswift ucswift merged commit 1e4e8a5 into master May 14, 2026
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant