Private Azure Artifacts feed and Docker

Creating a Docker image when all resources are publicly available is straightforward. The process can become more complex when some of the resources are coming from a private feed.

An approach to address this scenario is to create a nuget.config file, and then copy that into the layer that is restoring the project.

Below is a sample of nuget.config file from the documentation ¹. In line 5, you specify the location of the private feed. In lines 10 and 11, you specify your credentials to access the feed (more about that later).

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <packageSources>
    <add key="public" value="https://api.nuget.org/v3/index.json" />
    <add key="customfeed" value="<custom feed url>" />
  </packageSources>
 
  <packageSourceCredentials>
    <customfeed>
      <add key="Username" value="<username>" />
      <add key="ClearTextPassword" value="<password>" />
    </customfeed>
  </packageSourceCredentials>
</configuration>

In line 7 of the Docker file ² we copy the nuget.config file:

FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
 
WORKDIR /app
 
# Copy csproj and restore as distinct layers
COPY *.csproj .
COPY ./nuget.config .
RUN dotnet restore
 
# Copy and publish app and libraries
COPY . .
RUN dotnet publish -c Release -o out  --no-restore
 
 
FROM mcr.microsoft.com/dotnet/runtime:6.0 AS runtime
WORKDIR /app/
COPY --from=build /app/out ./
ENTRYPOINT ["dotnet", "dotnetapp.dll"]

The credentials for the nuget.config file are your user name, and a Personal Access Token (PAT).

To generate a PAT, go to Azure DevOps and click on the gear icon in the top right:

Then follow the steps to add a token:

Place the generated token in the nuget.config file. Now the image can be built.