Debian 11 images now available

[mthalman]

Debian 11 images now available

Debian 11 (Bullseye) container images have been released for .NET Core 3.1 & 5.0 (they were already previously available for .NET 6 previews). To consume this new version of Debian, you'll need to use one of the <dotnet-version>-bullseye tags. No change is being made to the floating 3.1 and 5.0 tags; these will continue to reference Debian 10 (Buster).

Details

• Add Debian Bullseye Dockerfiles for 3.1 and 5.0 #3113

The floating 3.1 and 5.0 tags are not being moved to reference Debian 11 since that would be a breaking change. So in order to consume this new version of Debian, you'll need to explicitly target it with the tag name: 3.1-bullseye, 5.0-bullseye. For other variations of these tag names for Debian 11, see the full list of documented tags on Docker Hub:

• dotnet/sdk
• dotnet/aspnet
• dotnet/runtime
• dotnet/runtime-deps

[mdhthahmd]

Hi,
is 5.0-bullseye tag omitted intentionally?, i see all dotnet 5.x version images have -slim appended to them.

due to this inconsistency for debian 11 image tags, the following Dockerfile would no longer work for across 3.1 and 5.0

# [Choice] .NET version: 5.0, 3.1
ARG VARIANT="3.1"
FROM mcr.microsoft.com/dotnet/sdk:${VARIANT}-bullseye

Note: this is not the case with ubuntu focal, as both 3.1-focal and 5.0-focal are available

[mthalman]

is 5.0-bullseye tag omitted intentionally?, i see all dotnet 5.x version images have -slim appended to them.

Yes, this is intentional. This change is only for the sdk repository and is due to the 5.0 SDK image ultimately being based on debian:buster-slim instead of debian:buster. You can find more info on this here. This doesn't apply to Ubuntu because there are no slim variants of those images.

[ThorstenHans]

Maybe a bit off-topic, but is bullseye the default for .NET 6?

[mthalman]

Maybe a bit off-topic, but is bullseye the default for .NET 6?

@ThorstenHans - Yes, it is.

[melvincanafranca]

Is the 372268-GNU Bash Privilege Escalation Vulnerability for Debian still present in the Debian 11 image?

CVE-2019-18276

Saw it still popping in the Qualys scan for Azure Container Registry.