Sail Sharp - Security best practices with .NET Core & Kubernetes

Associated blog posts:

• Sail Sharp, 8 tips to optimize and secure your .NET containers for Kubernetes
• alpine, distroless or scratch?
• Keyless Google Cloud Authentication to push your containers to Artifact Registry from GitHub Actions

Deploy the pre-built container with docker and kubectl

Run the pre-built container with Docker:

docker run \
    -d \
    -p 8080:8080 \
    --read-only \
    --cap-drop=ALL \
    --user=65532 \
    ghcr.io/mathieu-benoit/my-sample-workload:latest

Deploy the pre-built container on Kubernetes:

kubectl apply \
    -f deployment.yaml
kubectl apply \
    -f service.yaml

Build and deploy the container with Score with docker compose, kubectl and humctl

Build and run the container with Docker Compose:

make compose-up

make compose-test

Deploy the container in a local Kind cluster:

make kind-create-cluster

make kind-load-image

make k8s-up

make k8s-test

Deploy the pre-built container with Score/Humanitec:

humctl score deploy \
    --token ${HUMANITEC_TOKEN} \
    --org ${HUMANITEC_ORG} \
    --app ${APP_ID} \
    --env ${ENVIRONMENT_ID} \
    -f score/score.yaml \
    -i ghcr.io/mathieu-benoit/my-sample-workload:latest \
    --wait