We're well into our productization of the non-root scenario. It would make it easier for users to test the new experience if we published a .NET 8 app in our samples repo as non-root. For Kubernetes in particular, that would be very useful.

We typically wait for RC1 to push new images. In a lot of ways, that's a nice to have. This time around, it seems warranted to do something earlier since we're changing the way container images work, not just the product they contain.

It isn't entirely clear what to do that makes sense long-term.

Here's a proposal:

• Push and document a new non-root tag (with the aspnetapp sample), starting now.
• Leave the existing tags as .NET 7-based.
• With .NET 8 RC1, move the existing samples to .NET 8 and make them non-root.
• Continuing pushing the non-root tag and make it an alias of aspnetapp.
• Undocument the non-root tag at that time and push it through RC2 and then no longer push it after that.
• At GA, we're left with just dotnetapp and aspnetapp tags.

Use this Dockerfile: https://github.com/dotnet/dotnet-docker/blob/main/samples/aspnetapp/Dockerfile.alpine-non-root