An official image is a useful starting point, but an organization may need every application image to include the same security certificates or default settings. A golden image solves that problem: it builds on an approved base image, adds the organization’s standard configuration, and becomes the base for application images. section 5.5
A practical setup has three parts:
- Choose a suitable base. Prefer an image with what the application needs to run, without unnecessary build tools in the runtime image. section 17.2
- Build the golden image with a Dockerfile. Add shared configuration or metadata, give it your own image reference, and publish it to a company repository or registry. section 5.5
- Base application images on it. Your team can choose when to update the golden image and trigger application builds afterward; it can also add vulnerability scanning to the build process. section 5.5 section 17.2
Build separate .NET build and runtime bases
From the supplied exercise folders, run `docker image build -t golden/dotnet-sdk:2e .` in `ch05/exercises/dotnet-sdk`, then `docker image build -t golden/aspnet:2e .` in `ch05/exercises/aspnet-runtime`. In a multi-stage application Dockerfile, use `FROM golden/dotnet-sdk:2e AS builder` to publish the app, then `FROM golden/aspnet:2e` and copy in the published output. The application uses your maintained images without carrying the SDK into its runtime stage. section 5.5 section 17.2
Listing 5.1 A multi-stage Dockerfile using .NET golden images
FROM golden/dotnet-sdk:2e AS builder COPY . . RUN dotnet publish -o /out/app app.csproj FROM golden/aspnet:2e COPY --from=builder /out /app CMD ["dotnet", "/app/app.dll"]
See the complete multi-stage Dockerfile for the builder and runtime image references, publish command, copy instruction, and startup command. section 5.5
Keep the golden image small and fit for its job; curating a base is not a reason to add unnecessary packages or files. If future multi-platform support matters, start from a multi-platform image and avoid OS-specific `RUN` or `CMD` instructions. section 17.5 section 12.5
