C# Executable Packager

dotnet publish -c Release -r win-x64 \
  --self-contained true \
  -p:PublishSingleFile=true \
  -p:ReadyToRun=true \
  -p:PublishTrimmed=true \
  -p:TrimmerRootAssembly=true

Docker Hardening Checklist

• Base image uses mcr.microsoft.com/dotnet/runtime:8.0-alpine (minimal)
• Non-root user created and set: USER appuser
• OCI labels: org.opencontainers.image.version, build-date, vcs-url
• No secrets in image layers
• Vulnerability scan passes (trivy image or equivalent)
• Health check defined

Workflow

1. Configure .csproj for self-contained deployment
2. Run build-executables.sh for all target platforms
3. Build installer packages (MSI/DEB/RPM/DMG)
4. Build and harden Docker image
5. Run vulnerability scan
6. Publish to registry with versioned tags

When to Use

• Production delivery of C# CLI tools, services, or background workers
• Multi-platform distribution without .NET runtime preinstallation
• Docker containerization of C# applications

Golden Rules

See root SKILL.md Golden Rules for the full list.

• GR-2 — Docker Build & Compose Validation: The Docker image produced by build-docker-image.sh MUST build successfully and pass health check verification before delivery.

When NOT to Use

• Development/debug builds
• Web apps deployed to PaaS (Azure App Service, AWS Elastic Beanstalk)
• NuGet package creation
• ARM architecture targets