Dockerize

Introduction

The CDP4-COMET Webservices and database are available as Docker images. This page describes how to create the Docker images locally. To deploy these images refer to the Docker page. For complete documentation on Docker itself, please refer to the official docs

These docs are written for developers that have access to the Starion Group account on Docker Hub. However, if you don't have such an account you can still use these steps to build, tag and push to your own private docker repository.

This image can be pushed to a private repository or a public one such as Docker Hub.

Releasing a new Docker image

1. Prior to making a new release verify that all unit tests in the solution pass and that all the integration tests pass. If the tests fail FIX FIRST before you continue
2. Update the version number of the CometServer project and push to GitHub
3. Verify that the integration test suite executed by the GitHub action passes. If the tests fail FIX FIRST before you continue
4. Create a tag on GitHub
5. Build the image, attach the SBOM and provenance attestations, and push it to Docker Hub with the latest and version tags:

   ./docker-build-attested.sh x.y.z
   

   The script pulls the latest mcr.microsoft.com/dotnet/sdk:10.0 build image. The runtime image is the exact version in the FROM line of the Dockerfile (for example mcr.microsoft.com/dotnet/aspnet:10.0.13-alpine3.24). To build an image locally without pushing it, use ./docker-build-local.sh x.y.z.
6. Create release notes on GitHub using the previously created tag. State the .NET runtime version of the image (the runtime image in the FROM line of the Dockerfile), so that operators can tell whether their image is affected by a .NET security advisory. The running server logs the same information at startup:

   INF Runtime: .NET 10.0.13 on Alpine Linux v3.24 (linux-musl-x64)
   

7. Update the description on the Docker Hub page

.NET security releases

Microsoft publishes .NET servicing releases on the second Tuesday of the month ("Patch Tuesday"), most of them with security fixes. The Docker image contains the .NET runtime, so operators cannot apply these fixes themselves: they need a new CDP4-COMET image.

1. Dependabot (.github/dependabot.yml) checks every week and opens pull requests to development for:
   • the runtime image in the Dockerfile (for example aspnet:10.0.13-alpine3.24 to aspnet:10.0.14-alpine3.24);
   • the .NET NuGet packages (Microsoft.* and System.*), grouped into one pull request.
2. Merge these pull requests once the CI build, including the integration test suite, passes.
3. When a .NET release fixes a vulnerability in ASP.NET Core, Kestrel or the runtime, release a new patch version of the CDP4-COMET WebServices, even when nothing else changed, following Releasing a new Docker image.
4. Check dotnet list COMET-WebServices.sln package --vulnerable --include-transitive before the release. The nuget package reference check workflow runs the same check every day; GitHub disables scheduled workflows after 60 days without activity in the repository, so check that it is still enabled (gh workflow list --all).

The .NET releases are listed on the .NET 10 release notes page.