tibber/image-dotnet repository overview

⁠Tibber image for running .NET services

Images are published to ECR at 055209842064.dkr.ecr.eu-west-1.amazonaws.com/image-dotnet. Each build attaches the ASP.NET version it actually ships as extra tags, so the registry listing answers "what runs in prod" without resolving a digest:

All three tags on a row point at the same manifest; the version tags are re-pointed on every rebuild, so a pinned consumer still gets digest bumps.

⁠Directories that are not published to ECR

8/, 8-alpine/ and 8-alpine-tools/ have no CircleCI job, and ECR holds no tag for them — docker pull .../image-dotnet:8-alpine does not resolve. They are still built by a legacy Docker Hub autobuild into the public docker.io/tibber/image-dotnet repo (as 8.0, 8.0-alpine, 8.0-alpine-tools), which is the only registry serving those variants today. No repo in the Tibber org pins them. Do not pin them for new work.

⁠Which .NET version does an image actually run?

Both stages come from MCR and carry the same version, so unlike image-nodejs and image-python the FROM tag here is truthful. It is not always precise, though: only 10-chiseled/ pins a patch — 8-chiseled/ and 9-chiseled/ float on 8.0 / 9.0.

CI reads ASPNET_VERSION off the runtime image on every branch and prints it, so each Renovate PR reports the exact version its image ships. It is report-only and never fails the build. (It reads the image config rather than running dotnet --version: the chiseled images have no shell.)

⁠Pinning in a consuming service

Pin the version tag and the digest:

FROM 055209842064.dkr.ecr.eu-west-1.amazonaws.com/image-dotnet:10.0-chiseled@sha256:<digest>

They do two different jobs, and you want both:

• The digest controls what you run. Docker resolves the image by digest; the tag is a label and nothing checks the two agree. pinDigests in the shared preset adds the digest for you.
• The tag records which minor that digest is, so the Dockerfile answers "what .NET are we on?" without anyone resolving a hash — and it tells Renovate which update stream to follow.

Renovate maintains the pair together, so the bump you get reads:

Update image-dotnet 10.0-chiseled -> 10.1-chiseled

Pinning the bare 10-chiseled still works, and is what most services do today, but then the file records nothing and the bump reads Update image-dotnet:10-chiseled Docker digest to 1c4a9b7.

10.0.<patch>-chiseled is published too if you want the patch recorded.

⁠Local builds

To build locally, first download the prestop-signal binaries:

cd 10-chiseled  # or whichever image directory
VERSION=0.0.33
gh release download "v${VERSION}" --repo tibber/prestop-signal \
  --pattern "prestop-signal_${VERSION}_linux_amd64.tar.gz" \
  --output - | tar -xzf - --to-stdout prestop-signal > prestop-signal-amd64
gh release download "v${VERSION}" --repo tibber/prestop-signal \
  --pattern "prestop-signal_${VERSION}_linux_arm64.tar.gz" \
  --output - | tar -xzf - --to-stdout prestop-signal > prestop-signal-arm64

Then build the image:

docker buildx build --platform linux/amd64 -t image-dotnet:10-chiseled .

⁠This image is built in Circle CI.