--- title: "Securing ASP.NET Core in Docker - Muhammad Rehan Saeed" description: "How to secure your ASP.NET Core Docker image by setting the file system to be read-only. First in a series of blog posts covering Docker image security." canonical_url: "https://rehansaeed.com/securing-asp-net-core-in-docker/" last_updated: "2019-03-25T00:00:00+00:00" meta: author: "Muhammad Rehan Saeed" keywords: "ASP.NET Core,Docker,Docker Swarm,Kubernetes" "og:description": "How to secure your ASP.NET Core Docker image by setting the file system to be read-only. First in a series of blog posts covering Docker image security." "og:image": "https://rehansaeed.com/_og/s/o_974b9f8a3611f1dd.png" "og:image:alt": "Securing ASP.NET Core in Docker - Muhammad Rehan Saeed" "og:image:height": "630" "og:image:type": image/png "og:image:width": "1200" "og:title": "Securing ASP.NET Core in Docker" "twitter:image": "https://rehansaeed.com/_og/s/o_974b9f8a3611f1dd.png" "twitter:image:alt": "Securing ASP.NET Core in Docker - Muhammad Rehan Saeed" --- > Index of every page on this site: [llms.txt](https://rehansaeed.com/llms.txt) # [Securing ASP.NET Core in Docker](https://rehansaeed.com/securing-asp-net-core-in-docker/) Posted 25 March 2019 - **1 min read** ![Docker](https://rehansaeed.com/_ipx/f_png&s_2560x1440/images/hero/Docker-1366x768.png) Update (2020-10-12) Making the file system for an ASP.NET Core application read-only is great for security but under high load ASP.NET Core can buffer requests to disk. In this scenario, you will see exceptions. So weight the positives and negatives of doing this. Some time ago, I blogged about how you can get some [extra security when running Docker containers](https://rehansaeed.com/docker-read-file-systems/) by making their file systems read-only. This ensures that should an attacker get into the container somehow, they won't be able to change any files. This only works with certain containers that support it however and unfortunately, at that time ASP.NET Core did not support running in a Docker container with a read-only file system. Happily, this is now fixed! Lets see an example. I created a brand new hello world ASP.NET Core project and added this `Dockerfile`: ```dockerfile FROM microsoft/dotnet:2.2-sdk AS builder WORKDIR /source COPY *.csproj . RUN dotnet restore COPY . . RUN dotnet publish --output /app/ --configuration Release FROM microsoft/dotnet:2.2-aspnetcore-runtime WORKDIR /app COPY --from=builder /app . ENTRYPOINT ["dotnet", "ReadOnlyTest.dll"] ``` I build the Docker image using this command: ```powershell docker build -t read-only-test . ``` If I run this image with a read-only file system: ```powershell docker run --rm --read-only -it -p 8000:80 read-only-test ``` This outputs the following error as read-only file systems are not supported by default: ```text Failed to initialize CoreCLR, HRESULT: 0x80004005 ``` If I now run the same image with the `COMPlus_EnableDiagnostics` environment variable turned off: ```powershell docker run --rm --read-only -it -p 8000:80 -e COMPlus_EnableDiagnostics=0 read-only-test ``` The app now starts! The `COMPlus_EnableDiagnostics` environment variable (which is [documented here](https://docs.microsoft.com/en-us/dotnet/core/run-time-config/debugging-profiling#enable-diagnostics)) turns off debugging and profiling support, so I would not bake this environment variable into the `Dockerfile`. For some reason these features need a read/write file system to work properly. If you'd like to try this yourself, you can checkout all the code in [this repo](https://github.com/RehanSaeed/ReadOnlyDockerTest). ## Web Mentions [What's this?](https://en.wikipedia.org/wiki/Webmention) ### 0 Linked ### 0 Replies ## GitHub Comments ### 2 Comments [Comment on GitHub](https://github.com/RehanSaeed/rehansaeed.github.io/issues/111) [![Huffers](https://avatars.githubusercontent.com/u/26002523?v=4)](https://github.com/Huffers) ### [Huffers](https://github.com/Huffers) 12 October 2021 (edited 12 October 2021) The COMPlus\_EnableDiagnostics environment variable is now a documented setting, see the documentation for it here: https://docs.microsoft.com/en-us/dotnet/core/run-time-config/debugging-profiling [![RehanSaeed](https://avatars.githubusercontent.com/u/2270364?v=4)](https://github.com/RehanSaeed) ### [RehanSaeed](https://github.com/RehanSaeed) Owner 12 October 2021 [@Huffers](https://github.com/Huffers) Thanks, I've now updated the post. ```json {"@context":"https://schema.org","@graph":[{"@id":"https://rehansaeed.com/#website","@type":"WebSite","description":"Software Developer at Microsoft, YouTuber, Open Source Contributor and Blogger","inLanguage":"en-GB","name":"Muhammad Rehan Saeed","url":"https://rehansaeed.com/","author":{"@id":"https://rehansaeed.com/#identity"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://rehansaeed.com/?search={search_term_string}"},"query-input":"required name=search_term_string"}],"publisher":{"@id":"https://rehansaeed.com/#publisher"}},{"@id":"https://rehansaeed.com/securing-asp-net-core-in-docker/#webpage","@type":"WebPage","dateModified":"2019-03-25T00:00:00+00:00","datePublished":"2019-03-25T00:00:00+00:00","description":"How to secure your ASP.NET Core Docker image by setting the file system to be read-only. First in a series of blog posts covering Docker image security.","name":"Securing ASP.NET Core in Docker","url":"https://rehansaeed.com/securing-asp-net-core-in-docker/","breadcrumb":{"@id":"https://rehansaeed.com/securing-asp-net-core-in-docker/#breadcrumb"},"isPartOf":{"@id":"https://rehansaeed.com/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://rehansaeed.com/securing-asp-net-core-in-docker/"]}]},{"@id":"https://rehansaeed.com/#identity","@type":"Person","name":"Muhammad Rehan Saeed","url":"https://rehansaeed.com/about/","image":{"@id":"https://rehansaeed.com/#/schema/image/1"},"sameAs":["https://github.com/RehanSaeed","https://www.linkedin.com/in/muhammad-rehan-saeed","https://stackoverflow.com/users/1212017/muhammad-rehan-saeed","https://www.youtube.com/c/MuhammadRehanSaeed","https://www.twitch.tv/rehansaeeduk"]},{"@id":"https://rehansaeed.com/#publisher","@type":"Organization","logo":"https://rehansaeed.com/images/schema/Publisher-600x60.png","name":"Muhammad Rehan Saeed","url":"https://rehansaeed.com"},{"@id":"https://rehansaeed.com/securing-asp-net-core-in-docker/#article","@type":"Article","dateModified":"2019-03-25T00:00:00+00:00","datePublished":"2019-03-25T00:00:00+00:00","description":"How to secure your ASP.NET Core Docker image by setting the file system to be read-only. First in a series of blog posts covering Docker image security.","headline":"Securing ASP.NET Core in Docker","inLanguage":"en-GB","url":"https://rehansaeed.com/securing-asp-net-core-in-docker/","author":{"@id":"https://rehansaeed.com/#identity"},"image":[{"@type":"ImageObject","url":"https://rehansaeed.com/images/hero/Docker-1366x768.png","caption":"Docker","width":"1366","height":"768"}],"isPartOf":{"@id":"https://rehansaeed.com/securing-asp-net-core-in-docker/#webpage"},"keywords":["ASP.NET Core","Docker","Docker Swarm","Kubernetes"],"mainEntityOfPage":{"@id":"https://rehansaeed.com/securing-asp-net-core-in-docker/#webpage"},"publisher":{"@id":"https://rehansaeed.com/#publisher"}},{"@id":"https://rehansaeed.com/securing-asp-net-core-in-docker/#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Blog","item":"https://rehansaeed.com/","position":1},{"@type":"ListItem","name":"Securing ASP.NET Core in Docker","item":"https://rehansaeed.com/securing-asp-net-core-in-docker/","position":2}]},{"@id":"https://rehansaeed.com/#/schema/image/1","@type":"ImageObject","contentUrl":"https://rehansaeed.com/images/author/Muhammad-Rehan-Saeed/Logo-512x512.png","inLanguage":"en-GB","url":"https://rehansaeed.com/images/author/Muhammad-Rehan-Saeed/Logo-512x512.png"}]} ``` ## Sitemap See the full [sitemap](https://rehansaeed.com/sitemap.md) for all pages.