Microservices and containers for deploying them are standard in large companies. For developers and DevOps engineers, this is a convenient approach: it gives more opportunities and speeds up processes.

But for information security professionals, microservice architecture does not look so rosy. The more containers, the higher the risks. Moreover, most vulnerabilities are inherited from base images.

My name is Sasha Rakhmanny, I am a developer in the information security team at Lamoda Tech. In this article, I’ll compare different .NET base images in terms of component security and performance.

I’ve put together a cheat sheet to help you choose a base image for deploying your application, and also tell you how to reduce the number of packages and vulnerabilities in containers.

Working with vulnerabilities in containers

Let’s imagine that during the development of an application we encountered a problem: during the build stage, a critical vulnerability was discovered in the Docker container. The assembly stopped at the artifact scanning stage.

We went to look at the list of packages with vulnerabilities – and found out that at the moment there are neither new versions nor hotfixes for them to fix problems.

What to do next?

As we can see, it was worth thinking about the risks in advance. Choosing the right base image for your Docker container is key. The security, updates and stability of the application depend on it.

There are several methods to deal with this problem:

1. Get rid of unused packages. One way to reduce the attack surface is to remove all unnecessary packages from containers during the build phase that may contain vulnerabilities.
2. Technical protection. Implementation of Web Application Firewall, network segmentation and other solutions that will help protect the system from known vulnerabilities.
3. Taking risks. In some cases, risks can be accepted if the potential damage from the vulnerability is lower than the cost of fixing it. Knowing about the risk, we can connect additional sensors and set up alerts for events in the monitoring system.
4. Use of distroless (stripped-down) images. Using minimalistic container images with a limited set of components significantly reduces the number of potential vulnerabilities.

In this article I will focus on the last point. I’ll compare several basic images: I’ll show how the number of packages installed in them affects the number of identified vulnerabilities and performance, and I’ll compare the results.

I suggest comparing images using a test application as an example.

Test application

We use the standard Weather API template as a test application.

In Program.cs we will add the following method to display basic information about the environment:

app.MapGet("/Info", () => new
{
    Username = Environment.UserName,
    OS = Environment.OSVersion,
    IsDevelopment = app.Environment.IsDevelopment(),
    IsProduction = app.Environment.IsProduction(),
    IsStaging = app.Environment.IsStaging(),
    Hosts = File.ReadAllTextAsync("/etc/hosts"),
    Hash = DateTime.UtcNow.ToString("O").GetHashCode()
})
    .WithName("Get Env Information")
    .WithOpenApi();

Container SDK

The official image mcr.microsoft.com/dotnet/sdk:8.0 at the time of writing is built on the basis of a Debian 12 container with the .NET SDK installed and includes:

• .NET CLI
• .NET runtime
• ASP.NET Core

There are also options with Alpine 3.18-3.19, Ubuntu 22.04, CBL-Mariner 2.0.

Microsoft’s documentation recommends using this image only for the development or build phases.

Let’s write a Dockerfile for our demo application using the base image mcr.microsoft.com/dotnet/sdk:8.0 .

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
ARG BUILD_CONFIGURATION=Release
WORKDIR /src
COPY ["WebAppDemo/WebAppDemo.csproj", "WebAppDemo/"]
RUN dotnet restore "./WebAppDemo/WebAppDemo.csproj"
COPY . .
WORKDIR "/src/WebAppDemo"
RUN dotnet build "./WebAppDemo.csproj" -c $BUILD_CONFIGURATION -o /app/build
RUN dotnet publish "./WebAppDemo.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false
ENTRYPOINT ["dotnet", "/app/publish/WebAppDemo.dll"]

Let’s assemble and launch the container:

docker build -f WebAppDemo\Dockerfile -t webappdemo:sdk .
docker run -p 8080:8080 --name webapp-sdk -d webappdemo:sdk

Checking the work:

curl http://localhost:8080/info

{"username":"root","os":{"platform":4,"servicePack":"","version":"5.10.102.1","versionString":"Unix 5.10.102.1"},"isDevelopment":false,"isProduction":true,"isStaging":false,"hosts":"127.0.0.1\tlocalhost\n::1\tlocalhost ip6-localhost ip6-loopback\nfe00::0\tip6-localnet\nff00::0\tip6-mcastprefix\nff02::1\tip6-allnodes\nff02::2\tip6-allrouters\n172.17.0.3\t8553cab4aeb7\n","hash":1359993159}

Checking the image size:

docker inspect -f "{{ .Size }}" webappdemo:sdk

Let’s check the number of installed packages in the image:

syft webappdemo:sdk | grep deb

We will also check the number of vulnerabilities:

trivy image webappdemo:sdk

What happened:

[IterationCount(200)]
public class RestBenchmark
{
    private HttpClient _client;
    [GlobalSetup]
    public void GlobalSetup()
    {
        _client = new HttpClient();
    }
    [Benchmark]
    public async Task GetInfo()
    {
        var response = await _client.GetAsync("http://localhost:8080/info");
    }
}

FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base
WORKDIR /app
EXPOSE 8080

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
ARG BUILD_CONFIGURATION=Release
WORKDIR /src
COPY ["WebAppDemo/WebAppDemo.csproj", "WebAppDemo/"]
RUN dotnet restore "./WebAppDemo/WebAppDemo.csproj"
COPY . .
WORKDIR "/src/WebAppDemo"
RUN dotnet build "./WebAppDemo.csproj" -c $BUILD_CONFIGURATION -o /app/build

FROM build AS publish
ARG BUILD_CONFIGURATION=Release
RUN dotnet publish "./WebAppDemo.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "WebAppDemo.dll"]

USER app

FROM mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled AS base
USER app
WORKDIR /app
EXPOSE 8080

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
ARG BUILD_CONFIGURATION=Release
WORKDIR /src
COPY ["WebAppDemo/WebAppDemo.csproj", "WebAppDemo/"]
RUN dotnet restore "./WebAppDemo/WebAppDemo.csproj"
COPY . .
WORKDIR "/src/WebAppDemo"
RUN dotnet build "./WebAppDemo.csproj" -c $BUILD_CONFIGURATION -o /app/build

FROM build AS publish
ARG BUILD_CONFIGURATION=Release
RUN dotnet publish "./WebAppDemo.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "WebAppDemo.dll"]

# build stage
FROM mcr.microsoft.com/dotnet/sdk:8.0-jammy AS build
...
RUN wget -O somefile.tar.gz <URL> \
    && tar -oxzf aspnetcore.tar.gz -C /somefile-extracted
...

# final stage/image
FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-jammy-chiseled
...
COPY --from=build /somefile-extracted .
...

FROM mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled AS base
USER app
WORKDIR /app
EXPOSE 8080

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
ARG BUILD_CONFIGURATION=Release
WORKDIR /src
COPY ["WebAppDemo/WebAppDemo.csproj", "WebAppDemo/"]
RUN dotnet restore "./WebAppDemo/WebAppDemo.csproj"
COPY . .
WORKDIR "/src/WebAppDemo"
RUN dotnet build "./WebAppDemo.csproj" -c $BUILD_CONFIGURATION -o /app/build

FROM build AS publish
ARG BUILD_CONFIGURATION=Release
RUN dotnet publish "./WebAppDemo.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false

FROM ubuntu:22.04  AS dependency
RUN apt update && \
    apt install -y ca-certificates wget && \
    mkdir /rootfs && \
    wget -O chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.9.1/chisel_v0.9.1_linux_amd64.tar.gz \
    && tar -oxzf chisel.tar.gz -C / &&\
    ./chisel cut --root /rootfs libgcrypt20_libs

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
COPY --from=dependency /rootfs /
ENTRYPOINT ["dotnet", "WebAppDemo.dll"]

FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-jammy-chiseled AS base
USER app
WORKDIR /app
EXPOSE 8080

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
ARG BUILD_CONFIGURATION=Release
WORKDIR /src
COPY ["WebAppDemo/WebAppDemo.csproj", "WebAppDemo/"]
RUN dotnet restore "./WebAppDemo/WebAppDemo.csproj"
COPY . .
WORKDIR "/src/WebAppDemo"
RUN dotnet build "./WebAppDemo.csproj" -c $BUILD_CONFIGURATION -o /app/build

FROM build AS publish
ARG BUILD_CONFIGURATION=Release
RUN dotnet publish "./WebAppDemo.csproj" -c $BUILD_CONFIGURATION -o /app/publish -p:PublishTrimmed=true --runtime linux-x64 --self-contained true

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["/app/WebAppDemo"]

FROM mcr.microsoft.com/dotnet/aspnet:8.0-alpine AS base
USER app
WORKDIR /app
EXPOSE 8080

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
ARG BUILD_CONFIGURATION=Release
WORKDIR /src
COPY ["WebAppDemo/WebAppDemo.csproj", "WebAppDemo/"]
RUN dotnet restore "./WebAppDemo/WebAppDemo.csproj"
COPY . .
WORKDIR "/src/WebAppDemo"
RUN dotnet build "./WebAppDemo.csproj" -c $BUILD_CONFIGURATION -o /app/build

FROM build AS publish
ARG BUILD_CONFIGURATION=Release
RUN dotnet publish "./WebAppDemo.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "WebAppDemo.dll"]

FROM mcr.microsoft.com/dotnet/aspnet:8.0-cbl-mariner-distroless AS base
USER app
WORKDIR /app
EXPOSE 8080

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
ARG BUILD_CONFIGURATION=Release
WORKDIR /src
COPY ["WebAppDemo/WebAppDemo.csproj", "WebAppDemo/"]
RUN dotnet restore "./WebAppDemo/WebAppDemo.csproj"
COPY . .
WORKDIR "/src/WebAppDemo"
RUN dotnet build "./WebAppDemo.csproj" -c $BUILD_CONFIGURATION -o /app/build

FROM build AS publish
ARG BUILD_CONFIGURATION=Release
RUN dotnet publish "./WebAppDemo.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "WebAppDemo.dll"]