Docker & CI/CD In Depth

// Dev laptop     = same image as production
// CI pipeline    = dotnet test inside container → no "works on my machine"
// Rollback       = redeploy previous image tag in seconds
// Scale-out      = App Service / AKS runs N identical containers

// Typical pipeline:
//   git push → build image → run tests → push to registry → deploy tag

MyApi/
  src/MyApi/           # Web project
  tests/MyApi.Tests/
  Dockerfile
  docker-compose.yml
  .dockerignore
  .github/workflows/ci.yml

# syntax=docker/dockerfile:1
FROM mcr.microsoft.com/dotnet/sdk:9.0 AS build
WORKDIR /src
COPY ["src/MyApi/MyApi.csproj", "MyApi/"]
RUN dotnet restore "MyApi/MyApi.csproj"
COPY src/MyApi/ MyApi/
RUN dotnet publish "MyApi/MyApi.csproj" -c Release -o /app/publish /p:UseAppHost=false

FROM mcr.microsoft.com/dotnet/aspnet:9.0 AS final
WORKDIR /app
EXPOSE 8080
ENV ASPNETCORE_URLS=http://+:8080
USER $APP_UID
COPY --from=build /app/publish .
ENTRYPOINT ["dotnet", "MyApi.dll"]

**/bin/
**/obj/
**/.vs/
**/.git/
**/node_modules/
**/*.md
docker-compose*.yml

services:
  api:
    build: .
    ports: ["8080:8080"]
    environment:
      ConnectionStrings__Default: "Server=sql;Database=MyDb;User=sa;Password=Dev_Passw0rd!;TrustServerCertificate=True"
      ASPNETCORE_ENVIRONMENT: Development
    depends_on:
      sql:
        condition: service_healthy

  sql:
    image: mcr.microsoft.com/mssql/server:2022-latest
    environment:
      ACCEPT_EULA: "Y"
      MSSQL_SA_PASSWORD: "Dev_Passw0rd!"
    ports: ["1433:1433"]
    healthcheck:
      test: /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "Dev_Passw0rd!" -C -Q "SELECT 1" || exit 1
      interval: 10s
      retries: 10

# docker-compose.override.yml — bind-mount source for dotnet watch
services:
  api:
    build:
      target: build   # stop at SDK stage
    command: dotnet watch run --project MyApi/MyApi.csproj --urls http://0.0.0.0:8080
    volumes:
      - ./src/MyApi:/src/MyApi

# .github/workflows/ci.yml
name: CI
on:
  push:
    branches: [main]
  pull_request:

jobs:
  build-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: "9.0.x"
      - run: dotnet restore
      - run: dotnet build --no-restore -c Release
      - run: dotnet test --no-build -c Release --verbosity normal

  docker:
    needs: build-test
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          registry: ${{ secrets.ACR_LOGIN_SERVER }}
          username: ${{ secrets.ACR_USERNAME }}
          password: ${{ secrets.ACR_PASSWORD }}
      - uses: docker/build-push-action@v6
        with:
          push: true
          tags: ${{ secrets.ACR_LOGIN_SERVER }}/myapi:${{ github.sha }}

// Integration tests spin real SQL in Docker during dotnet test
public class OrderApiTests : IAsyncLifetime
{
    private readonly MsSqlContainer _sql = new MsSqlBuilder().Build();

    public async Task InitializeAsync() => await _sql.StartAsync();
    public async Task DisposeAsync() => await _sql.DisposeAsync();

    [Fact]
    public async Task GetOrder_returns_200()
    {
        await using var factory = new WebApplicationFactory<Program>()
            .WithWebHostBuilder(b =>
                b.UseSetting("ConnectionStrings:Default", _sql.GetConnectionString()));
        // ...
    }
}

  deploy:
    needs: docker
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
      - uses: azure/webapps-deploy@v3
        with:
          app-name: myapi-prod
          images: ${{ secrets.ACR_LOGIN_SERVER }}/myapi:${{ github.sha }}

# Web app → Deployment Center → Container Registry
# Or CLI:
az webapp config container set \
  --name myapi-prod \
  --resource-group rg-prod \
  --docker-custom-image-name myregistry.azurecr.io/myapi:latest \
  --docker-registry-server-url https://myregistry.azurecr.io

# Always pull specific SHA tag in CI — avoid :latest in production

var builder = WebApplication.CreateBuilder(args);

if (!builder.Environment.IsDevelopment())
{
    var vaultUri = new Uri($"https://{builder.Configuration["KeyVaultName"]}.vault.azure.net/");
    builder.Configuration.AddAzureKeyVault(vaultUri, new DefaultAzureCredential());
}

// Secret "ConnectionStrings--Default" in vault maps to ConnectionStrings:Default
var conn = builder.Configuration.GetConnectionString("Default");

# Federated credential on App Registration
# GitHub secret AZURE_CREDENTIALS replaced by:
- uses: azure/login@v2
  with:
    client-id: ${{ secrets.AZURE_CLIENT_ID }}
    tenant-id: ${{ secrets.AZURE_TENANT_ID }}
    subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

builder.Services.AddHealthChecks()
    .AddSqlServer(builder.Configuration.GetConnectionString("Default")!)
    .AddCheck("self", () => HealthCheckResult.Healthy());

var app = builder.Build();
app.MapHealthChecks("/health/live",  new HealthCheckOptions { Predicate = _ => false });
app.MapHealthChecks("/health/ready", new HealthCheckOptions { Predicate = c => c.Tags.Contains("ready") });

# Dockerfile
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD curl -f http://localhost:8080/health/live || exit 1

# App Service → Health check path: /health/ready
# Unhealthy instances removed from load balancer automatically

# Redeploy last known-good SHA
az webapp config container set \
  --name myapi-prod \
  --resource-group rg-prod \
  --docker-custom-image-name myregistry.azurecr.io/myapi:abc123def

# Or swap staging slot back if bad deploy reached production