Default .NET 8 container images to use the app user

[baronfel]

Requires #115 and #198.

For .NET 8 Containers Microsoft provides a non-root user named app. We should default folks into running rootless, so we should set ContainerUser according to the following decision tree.

• the ContainerBaseImage is dotnet/runtime-deps, dotnet/runtime, or dotnet/aspnet and
• the ContainerImageTags contains any 8.0 tag (including previews and/or rc tags) then
• if the ContainerRuntimeIdentifier is a Windows RID then use ContainerUser, else if the ContainerRuntimeIdentifier is a Linux RID then use app, otherwise
• do not set the ContainerUser

[richlander]

I'm not sure if sdk-container-builds supports Windows. For Windows, we are not adding app but plan to rely on ContainerUser, which already exists there. We could infer that, or the user would write <ContainerUser>ContainerUser</ContainerUser>. Fun!

[baronfel]

We do not currently due to but hopefully will thanks to #343, so we should be forward-looking here as well. Updated the OP with the Windows User and scenario.

[baronfel]

Per dotnet/dotnet-docker#4451 (comment), we should bias towards using the user id instead of the user name for our home-grown users (and probably also document that some engines like Kubernetes work better with ids), and so we should use 64198 instead of app in our targets. We should put a comment alongside so that the reason for the value isn't lost.

[richlander]

I will have more content written on this topic soon.

[richlander]

FYI: dotnet/dotnet-docker#4508

[baronfel]

Thanks for the heads-up, will extract this to a separate issue.