Ship the container

The run stage of the Dockerfile is the whole API: one image, built on mcr.microsoft.com/dotnet/aspnet:10.0-alpine, that listens on port 8080 and runs as the image’s non-root app user. It runs anywhere a container runs, which these days is everywhere, including a surprising number of fridges.

Build it

docker build . --target run --tag acme-movies:1.2.3 \
  --build-arg VERSION_PREFIX=1.2.3

The version is stamped into the assemblies, so GET /api/version tells you exactly which build is running. See the configuration reference for every build argument.

Pick an environment

DOTNET_ENVIRONMENT chooses which appsettings.*.json file is layered on top of appsettings.json.

Environment	Logs	Sample data	Meant for
`local`	Console	On	`dotnet run` on your machine
`docker`	Seq	On	`docker compose up` on your machine
Anything else	Whatever you configure	Off	Production, staging, and anywhere data matters

For production, pick a name like production, add an appsettings.production.json with a Serilog sink you can read, and leave Database:SeedSampleData alone. The default is off, so a fresh database stays empty until something real writes to it.

Put it behind HTTPS

The container only listens on HTTP. Outside the local and Development environments it sends an HSTS header and redirects HTTP to HTTPS, which means it expects something in front of it to end TLS: a load balancer, a reverse proxy or your platform’s ingress. Tell it so:

ASPNETCORE_FORWARDEDHEADERS_ENABLED=true

Without that, the API thinks every request arrived over plain HTTP and redirects it, and the proxy sends it back, and the two of them go round and round until someone’s pager goes off.

Wire up the health checks

Endpoint	Checks	Use it for
`/health/live`	Nothing beyond the process answering	Liveness probes and the image’s own `HEALTHCHECK`
`/health/ready`	The database can be reached	Readiness probes, so traffic waits until the API can actually serve it

Both answer without a token, even when authentication is on.

Keep the data somewhere safe

The SQLite file lives in /app/data. Mount a volume there or, better, point Infrastructure at a real database before anyone relies on it. A database inside a container that gets replaced on every deploy is a database with a short memory.

Turn authentication on

Set Authentication__Authority and Authentication__Audience as environment variables, or bake them in with the template options when you create the solution. The security guide has the details.