Tag: Developer Tools

.NET 6 is now included in Ubuntu 22.04 (Jammy) and can be installed with just apt install dotnet6. This change is a major improvement and simplification for Ubuntu users. We’re also releasing .NET with Chiseled Ubuntu Containers, a new small and secure container offering from Canonical. These improvements are the result of a new partnership between Canonical and Microsoft.

Here’s the commands to install the .NET 6 SDK on Ubuntu 22.04:

sudo apt update
sudo apt install dotnet6

We’re also announcing that .NET 6 is available with Chiseled Ubuntu Containers. Our friends at Canonical have developed a new chisel approach for making ultra-small container images. We’re very excited about it. The Chiseled Ubuntu image is 100MB smaller than the Ubuntu images you’ve been using until now!

Here’s the command to pull the new ASP.NET Chiseled image:

docker pull mcr.microsoft.com/dotnet/nightly/aspnet:6.0-jammy-chiseled

We also updated our dotnetapp and aspnetapp samples so that you can try out .NET with Chiseled Ubuntu Containers.

These new container images significantly improve security posture:

• Ultra-small images (reduced size and attack surface)
• No package manager (avoids a whole class of attacks)
• No shell (avoids a whole class of attacks)
• Non-root (avoids a whole class of attacks)

To top that off, Canonical and Microsoft are committed to working together to ensure that new .NET releases are available with new Ubuntu releases and that they work well together. This includes security updates and secure delivery of container images.

We’re really excited that .NET 6 is available in Ubuntu 22.04 and that Canonical chose to work with us as their launch partner for Chiseled Ubuntu images. This is what Canonical had to say about the project.

“Ubuntu now has an end-to-end story from development to production with ultra-small supported container images, starting with the .NET platform”, said Valentin Viennot, Product Manager at Canonical. “We think it’s a huge improvement for both our communities; collaborating with the .NET team at Microsoft has enabled us to go above and beyond”.

Canonical and Microsoft

Several months ago, folks at Canonical and Microsoft started working together with the goal of making Ubuntu an even better environment for .NET devs.

We had two main goals in mind:

• Simplify using .NET on Ubuntu.
• Shorten the supply chain between Canonical and Microsoft.

We’ve known for years that many .NET devs use Ubuntu. After we got talking, it became obvious that there was a fair bit we could do to make that experience better. Let me tell you what we’ve delivered.

.NET in APT

You can now install .NET 6 with APT, built by Canonical via source-build. These packages are available with Ubuntu 22.04 (Jammy) and later. It’s a great reason to upgrade to Jammy!

Note: Please checkout this advisory on using packages.microsoft.com on Ubuntu 22.04 now that .NET 6 is included in Ubuntu.

There are multiple packages:

I’ll show you how to install these images using Docker (same model applies elsewhere):

rich@kamloops:~$ docker run --rm -it ubuntu:jammy
root@7d4dfca0ef55:/# apt update && apt install -y dotnet6
root@7d4dfca0ef55:/# dotnet --version
6.0.108

In case that doesn’t work, you need the following source registered, in /etc/apt/sources.list:

deb http://archive.ubuntu.com/ubuntu/ jammy-updates universe

Canonical and Microsoft will be working together to ensure that these packages are updated on the monthly .NET team release schedule. This includes Microsoft sharing CVE information (descriptions and code) with Canonical ahead of public releases. Similarly, Canonical will share security information in the other direction.

Notes:

• We’re currently missing Arm64 builds. Those will be coming soon. Both companies are strong proponents of Arm64.
• .NET 7 builds are not yet available, and likely won’t be until .NET 7 GA.
• .NET SDK workloads are not available in packages (for any Linux distro). Also, the .NET MAUI workloads isn’t supported on Linux.

.NET in Chiseled Ubuntu Containers

You can now use .NET in Chiseled Ubuntu Containers. Chiseling delivers the smallest container footprint while still being the Ubuntu you know and trust. It is similar to conventional distroless, with a tool that is customized for slicing .deb packages.

These images are 100MB smaller than the Ubuntu images we’ve offered until now and don’t include a root user!

We’re offering three layers of Chiseled Ubuntu container images, for Arm64 and x64, for .NET 6 and 7:

• mcr.microsoft.com/dotnet/nightly/runtime-deps:6.0-jammy-chiseled
• mcr.microsoft.com/dotnet/nightly/runtime:6.0-jammy-chiseled
• mcr.microsoft.com/dotnet/nightly/aspnet:6.0-jammy-chiseled

Note: The images will be offered in our nightly repos while the chiseled offering is in preview. We’ll make another announcement when they are supported in production. It will be sometime this year, but we haven’t picked a timeframe, since we’ve been focused on basic enablement.

Canonical is also publishing Chiseled Ubuntu container images for .NET, that include the new APT packages, via Docker Hub:

• https://hub.docker.com/r/ubuntu/dotnet-deps
• https://hub.docker.com/r/ubuntu/dotnet-runtime
• https://hub.docker.com/r/ubuntu/dotnet-aspnet

Let’s take a look at the size win. All of the following sizes are uncompressed (on-disk, not registry/wire size).

First, the runtime-deps layer.

• Ubuntu 22.04 (Jammy): 112MB
• Chiseled Ubuntu 22.04 (Jammy): 12.9MB

And on the other end of the spectrum, the aspnet layer.

• Ubuntu 22.04 (Jammy): 213MB
• Chiseled Ubuntu 22.04 (Jammy): 104MB

That’s a truly amazing difference! The folks at Canonical have figured out how to drop 100MB of binaries and other content from these images. When we first started talking, we had no idea we’d be talking about this large of a difference!

Close readers will notice that chiseled aspnet is smaller than the existing runtime-deps layer. That’s shockingly good.

It’s reasonable to ask what Alpine looks like. It’s a newer distro designed to be super small and componentized from the start. Alpine is 9.84MB for runtime-deps:6.0-alpine and 100MB for aspnet:6.0-alpine. Those are impressive numbers, again uncompressed. That’s the key reason why Alpine is so popular (and why we’ve published .NET images for it for years).

Alpine is great (and we’re also friends with those folks), but it isn’t for everyone and every app since it uses musl, which is a different (and incompatible) libc variant. That’s only important if your app includes native libraries. If it doesn’t (and most .NET apps don’t), you don’t need to worry about this detail. The .NET product itself is happy running with either musl or glibc and every PR on dotnet/runtime tests for both.

Putting this in perspective, this is really great news if you use Ubuntu for development and always wished for a small Ubuntu to deliver into production. You now have a straightforward path from dev box to cloud without any distro-compatibility surprises. It’s amazing (and quite surprising) to see Ubuntu in the same ballpark as Alpine. Kudos to the Canonical folks on a great engineering accomplishment.

It’s also worth mentioning that Chainguard is looking at minimal container images towards a secure future. That project is run out of the distroless GitHub org. We’re watching that project and glad to see more interest in small and more secure container images. We believe that minimal + non-root container images are the future.

Like our Alpine images, we’ve chosen not to include ICU. It would likely double the size of the image. That means that we’ve enabled globalization invariant mode. For some apps, that’s fine, and the size win is great. For others, it is a deal breaker. We may need to adjust this part of the plan depending on the feedback. We’ve documented the pattern to add ICU into your images.

Let me demo these images a bit to drive the point home on how (intentionally) limited these images are.

% docker run --rm mcr.microsoft.com/dotnet/nightly/runtime-deps:6.0-jammy-chiseled-amd64
docker: Error response from daemon: No command specified.
See 'docker run --help'.

Let’s try again.

% docker run --rm mcr.microsoft.com/dotnet/nightly/runtime-deps:6.0-jammy-chiseled-amd64 bash
docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: "bash": executable file not found in $PATH: unknown.

Huh? What’s up? They don’t work! That’s the point. These are appliance-like container images. They are stripped down to the minimum. They are only intended to do what you design them to do. That’s the aspect that makes them more secure. If this experience is uncomfortable, you can always use the regular Ubuntu images. We’ll continue to offer them. They are not going away.

We’re not offering a chiseled SDK image. It wasn’t obvious that there was a strong need. In fact, a chiseled SDK image could be hard to use for some scenarios. You can continue to use the existing Jammy SDK image: mcr.microsoft.com/dotnet/sdk:6.0-jammy. If there is a need for a chiseled SDK image, we’ll be happy to reconsider.

Using chiseled container images

For most apps, there won’t be any notable difference in using these new container images, in terms of what your Dockerfile looks like.

We made updated our samples to use these new containers images:

I’ll show you how easy this is with dotnetapp.

The Dockerfile is barely different.

FROM mcr.microsoft.com/dotnet/sdk:7.0-jammy AS build
WORKDIR /source # copy csproj and restore as distinct layers
COPY *.csproj .
RUN dotnet restore --use-current-runtime # copy and publish app and libraries
COPY . .
RUN dotnet publish -c Release -o /app --use-current-runtime --self-contained false --no-restore # final stage/image
FROM mcr.microsoft.com/dotnet/nightly/runtime:7.0-jammy-chiseled
WORKDIR /app
COPY --from=build /app .
ENTRYPOINT ["dotnet", "dotnetapp.dll"]

Only the final FROM statement really differs from our standard Ubuntu Dockerfile.

I’ll now build the sample:

rich@MacBook-Air-2 dotnetapp % pwd
/Users/rich/git/dotnet-docker/samples/dotnetapp
rich@MacBook-Air-2 dotnetapp % docker build -t dotnetapp-chiseled -f Dockerfile.chiseled .
rich@MacBook-Air-2 dotnetapp % docker images | grep dotnetapp-chiseled
dotnetapp-chiseled latest bf7e125bd182 20 seconds ago 90.5MB

Note: I didn’t use any .NET trimming features. Certainly, this image could be made smaller.

Let’s launch the container:

rich@MacBook-Air-2 dotnetapp % docker run --rm dotnetapp-chiseled 42 42 ,d ,d 42 42 42 ,adPPYb,42 ,adPPYba, MM42MMM 8b,dPPYba, ,adPPYba, MM42MMM
a8" `Y42 a8" "8a 42 42P' `"8a a8P_____42 42
8b 42 8b d8 42 42 42 8PP""""""" 42 "8a, ,d42 "8a, ,a8" 42, 42 42 "8b, ,aa 42, `"8bbdP"Y8 `"YbbdP"' "Y428 42 42 `"Ybbd8"' "Y428 .NET 7.0.0-preview.7.22375.6
Linux 5.10.104-linuxkit #1 SMP PREEMPT Thu Mar 17 17:05:54 UTC 2022 OSArchitecture: Arm64
ProcessorCount: 4
TotalAvailableMemoryBytes: 3.83 GiB

And then, let’s try to break in:

rich@MacBook-Air-2 dotnetapp % docker run --rm --entrypoint bash dotnetapp-chiseled
docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: "bash": executable file not found in $PATH: unknown.
rich@MacBook-Air-2 dotnetapp % docker run --rm --entrypoint apt dotnetapp-chiseled install -y bash curl
docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: "apt": executable file not found in $PATH: unknown.

My “red team” skills are failing me. Note that docker exec would have the same result.

I’ll now describe chiseled images in a bit more detail now that you’ve seen them in action.

Chiseled Ubuntu Containers

Chiseled Ubuntu Containers are the Canonical take on the distroless concept, originally popularized by Google. With the original implementation, a distro is stripped bare and only necessary packages are installed. Chiseling takes this one step forward by installing only the directories and files in each package that are necessary.

The other challenge with the original implementation was that it wasn’t necessarily supported by any party. Chiseled Ubuntu Containers are a first-class Canonical deliverable. That means you can use ultra-small container images and be supported as a Canonical customer.

Hats off to Google for getting us all started down this path.

As stated earlier, there is a lot of value to this approach:

• Ultra-small images (reduced size and attack surface)
• No package manager (avoids a whole class of attacks)
• No shell (avoids a whole class of attacks)

Chiseled Ubuntu Containers are currently in preview. We’ll make a separate announcement when they are stable and supported in production.

Non-root images

We’ve configured all of the new .NET Chiseled Ubuntu Containers with a non-root user. The images do not include the root user or include root-elevating commands like sudo or su. That means that it is not possible to exercise capabilities and operations that require root.

Non-root images are an additional security mitigation beyond removing a shell (like bash). Non-root images are logically separate and complementary to running a daemon as rootless. Every reduction in privilege helps.

If you need access to privileged resources, you can add the root user within your Dockerfile. You are not prevented from that, but then that’s a specific security decision you’d be making.

Chiseled images are appliance-like and are not general-purpose. We felt that they offered us an opportunity to finally deliver non-root images. That’s informing our policy going forward. Appliance-like images will be delivered as non-root and general-purpose ones will be delivered as per the policy of the base image (which might be configured with the root user). However, this project with Canonical has inspired us to look at a middle-ground option, of offering non-root-capable images.

Secure supply chain

Canonical already has secure processes in place for directly delivering Ubuntu Virtual Machine images to Azure for customers to use. It occurred to us that Canonical could do the same thing with the Ubuntu container base images that we use to build Ubuntu-based .NET images (regular and Chiseled). That’s what we’re now using, instead of pulling from Docker Hub. We now have what’s effectively a zero-distance supply chain for all Canonical assets with known custody/provenance throughout.

We’re doing something similar with sharing CVE fixes. We have a shared private virtual mono repo for sharing monthly patches. It’s also shared with Red Hat. It means we can work together on getting the correct fixes in place at the right time in a coordinated way.

.NET container images are not yet signed, but that’s coming relatively soon. We’re regularly working to improve our security-focused capabilities.

Support

Canonical and Microsoft have been working together to give you a better experience. This includes support. You can report issues in the familiar .NET repos like dotnet/core and dotnet/runtime. If you want commercial support, you should start with Canonical support. Canonical is the best position to support Ubuntu packages. Canonical may contact Microsoft to assist with resolving issues, as needed.

Security researchers that find vulnerabilities in Canonical-provided .NET packages are still eligible for the Microsoft .NET Bounty Program.

Microsoft continues to maintain .NET packages in its packages.microsoft.com feed for Ubuntu and we intend to continue that going forward. For most users, we recommend using the dotnet6 packages that come with Ubuntu Jammy+. That’s what I’ll be doing. It’s also the same guidance we have for Red Hat users.

Note: Please checkout this advisory on using packages.microsoft.com on Ubuntu 22.04 now that .NET 6 is included in Ubuntu.

There are two main reasons to continue to use the Microsoft packages:

• You specifically want .NET builds from Microsoft, not any other vendor.
• The Microsoft packages target later .NET SDK feature bands (like 6.0.4xx) while source-build tracks 6.0.1xx. That’s more relevant for Windows users, but might be important for some Linux users.

The new packages are available for .NET 6+ and Ubuntu 22.04+. Previous .NET and Ubuntu versions are not supported (with the new packages). You must use the existing packages.microsoft.com feed to use .NET on earlier Ubuntu versions. Separately, earlier .NET versions are not supported on Ubuntu 22.04 because they do not support OpenSSL v3.

What’s Next?

We have identified a number of opportunities to make it easier for Canonical to consume .NET source. We’re going to focus on those in the immediate term. These improvements will also benefit other users who build and distribute .NET from source.

We recently setup a distro-maintainer group for .NET. Canonical is a member of that group. We have already started discussing potential source-build improvements within that forum. Other distros (that build .NET from source) are welcome to join. Contact [email protected] for more information.

Canonical is starting out with support for x64 and will quickly add .NET packages for Arm64. It’s an exciting time in the industry with multiple mainline chip architectures to support. Ubuntu and .NET both have a long history of supporting multiple architectures.

Closing

.NET has been open source for just over 5 years now. A partnership with Canonical was felt out of grasp during the early days of our project on GitHub. We’ve learned a lot about how to structure an OSS project so that it is a candidate for inclusion in a Linux distro. This is thanks to our other partners who have taught us a lot, particularly Fedora and Red Hat. Looking back, it is easy to see that open source, trust, and industry relationships are even more important now than they were when we started. We’re excited and honored to be working with Canonical.

Many IT organizations must choose between giving developers the flexibility they need to be productive and keeping developer workstations managed and secure. Supply chain challenges have led to developers waiting weeks or months to get the hardware they need, forcing them to use aging hardware or unsecured personal devices. At the same time, hybrid work has forced IT to open access to corporate and on-premises resources to developers around the world. With access to sensitive source code and customer data, developers are increasingly becoming the target of more sophisticated cyberattacks.

Today, we’re excited to announce the preview of Microsoft Dev Box is now available to the public. Microsoft Dev Box is a managed service that enables developers to create on-demand, high-performance, secure, ready-to-code, project-specific workstations in the cloud. Sign in to the Azure portal and search for “dev box” to begin creating dev boxes for your organization.

Focus on code—not infrastructure

With Microsoft Dev Box, developers can focus on writing the code only they can write instead of trying to get a working environment that can build and run the code. Dev boxes are ready-to-code and preconfigured by the team with all the tools and settings developers need for their projects and tasks. Developers can create their own dev boxes whenever they need to quickly switch between projects, experiment on a proof-of-concept, or kick off a full build in the background while they move on to the next task.

Microsoft Dev Box supports any developer IDE, SDK, or tool that runs on Windows. Developers can target any development workload that can be built from Windows including desktop, mobile, IoT, and web applications. Microsoft Dev Box even supports building cross-platform apps thanks to Windows Subsystem for Linux and Windows Subsystem for Android. Remote access gives developers the flexibility to securely access dev boxes from any device, whether it’s Windows, MacOS, Android, iOS, or a web browser.

Tailor dev boxes to the needs of the team

With Microsoft Dev Box, developer teams create and maintain dev box images with all the tools and dependencies their developers need to build and run their applications. Developer leads can instantly deploy the right size dev box for specific roles in a team anywhere in the world, selecting from 4 vCPU / 16GB to 32 vCPU / 128GB SKUs to scale to any size application. By deploying dev boxes in the closest Azure region and connecting via the Azure Global Network, dev teams ensure a smooth and responsive experience with gigabit connection speeds for developers around the world.

Using Azure Active Directory groups, IT admins can grant access to sensitive source code and customer data for each project. With role-based permissions and custom network configurations, developer leads can give vendors limited access to the resources they need to contribute to the project—eliminating the need to ship hardware to short-term contractors and helping keep development more secure.

Centralize governance and management

Developer flexibility and productivity can’t come at the expense of security or compliance. Microsoft Dev Box builds on Windows 365, making it easy for IT administrators to manage dev boxes together with physical devices and Cloud PCs through Microsoft Intune and Microsoft Endpoint Manager. IT admins can set conditional access policies to ensure users only access dev boxes from compliant devices while keeping dev boxes up to date using expedited quality updates to deploy zero-day patches across the organization and quickly isolate compromised devices. Endpoint Manager’s deep device analytics make it easy to audit application health, device utilization, and other critical metrics, giving developers the confidence to focus on their code knowing they’re not exposing the organization to any unnecessary risk.

Microsoft Dev Box uses a consumption-based compute and storage pricing model, meaning organizations only pay for what they use. Automated schedules can warm up dev boxes at the start of the day and stop them at the end of the day while they sit idle. With hibernation, available in a few weeks, developers can resume a stopped dev box and pick up right where they left off.

Get started now

Microsoft Dev Box is available today as a preview from the Azure Portal. During this period, organizations get the first 15 hours of the dev box 8vCPU and 32 GB Memory SKU for free every month, along with the first 365 hours of the dev box Storage SSD 512 GB SKU. Beyond that, organizations pay only for what they use with a consumption-based pricing model. With this model, organizations are charged on a per-hour basis depending on the number of Compute and Storage that are consumed.

To learn more about Microsoft Dev Box and get started with the service, visit the Microsoft Dev Box page or find out how to deploy your own Dev Box from a pool.

Microsoft is dedicated to working with the community and our customers to continuously improve and tune our platform and products to help defend against the dynamic and sophisticated threat landscape. Earlier this year, we announced that we would replace the existing software testing experience known as Microsoft Security and Risk Detection with an automated, open-source tool as the industry moved toward this model. Today, we’re excited to release this new tool called Project OneFuzz, an extensible fuzz testing framework for Azure. Available through GitHub as an open-source tool, the testing framework used by Microsoft Edge, Windows, and teams across Microsoft is now available to developers around the world.

Fuzz testing is a highly effective method for increasing the security and reliability of native code—it is the gold standard for finding and removing costly, exploitable security flaws. Traditionally, fuzz testing has been a double-edged sword for developers: mandated by the software-development lifecycle, highly effective in finding actionable flaws, yet very complicated to harness, execute, and extract information from. That complexity required dedicated security engineering teams to build and operate fuzz testing capabilities making it very useful but expensive. Enabling developers to perform fuzz testing shifts the discovery of vulnerabilities to earlier in the development lifecycle and simultaneously frees security engineering teams to pursue proactive work.

Microsoft’s goal of enabling developers to easily and continuously fuzz test their code prior to release is core to our mission of empowerment. The global release of Project OneFuzz is intended to help harden the platforms and tools that power our daily work and personal lives to make an attacker’s job more difficult.

Recent advancements in the compiler world, open-sourced in LLVM and pioneered by Google, have transformed the security engineering tasks involved in fuzz testing native code. What was once attached—at great expense—can now be baked into continuous build systems through:

• Crash detection, once attached via tools such as Electric Fence, can be baked in with asan.
• Coverage tracking, once attached via tools such as iDNA, Dynamo Rio, and Pin can be baked in with sancov.
• Input harnessing, once accomplished via custom I/O harnesses, can be baked in with libfuzzer’s LLVMFuzzerTestOneInput function prototype.

These advances allow developers to create unit test binaries with a modern fuzzing lab compiled in: highly reliable test invocation, input generation, coverage, and error detection in a single executable. Experimental support for these features is growing in Microsoft’s Visual Studio. Once these test binaries can be built by a compiler, today’s developers are left with the challenge of building them into a CI/CD pipeline and scaling fuzzing workloads in the cloud.

Project OneFuzz has already enabled continuous developer-driven fuzzing of Windows that has allowed Microsoft to proactively harden the Windows platform prior to shipment of the latest OS builds. With a single command line (baked into the build system!) developers can launch fuzz jobs ranging in size from a few virtual machines to thousands of cores. Project OneFuzz enables:

• Composable fuzzing workflows: Open source allows users to onboard their own fuzzers, swap instrumentation, and manage seed inputs.
• Built-in ensemble fuzzing: By default, fuzzers work as a team to share strengths, swapping inputs of interest between fuzzing technologies.
• Programmatic triage and result deduplication: It provides unique flaw cases that always reproduce.
• On-demand live-debugging of found crashes: It lets you summon a live debugging session on-demand or from your build system.
• Observable and Debug-able: Transparent design allows introspection into every stage.
• Fuzz on Windows and Linux OSes: Multi-platform by design. Fuzz using your own OS build, kernel, or nested hypervisor.
• Crash reporting notification callbacks: Currently supporting Azure DevOps Work Items and Microsoft Teams messages

Project OneFuzz is available now on GitHub under an MIT license. It is updated by contributions from Microsoft Research & Security Groups across Windows and by more teams as we grow our partnership and expand fuzzing coverage across the company to continuously improve the security of all Microsoft platforms and products. Microsoft will continue to maintain and expand Project OneFuzz, releasing updates to the open-source community as they occur. Contributions from the community are welcomed. Share questions, comments, and feedback with us: [email protected]

To learn more about Microsoft Security solutions visit our website.  Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity.