如何在基于dotnet/aspnet:6.0的Windows多阶段Docker容器中添加PowerShell？

针对你的Windows Docker容器需求，要在最终的base阶段（基于mcr.microsoft.com/dotnet/aspnet:6.0）添加PowerShell以导入Always Encrypted证书，可通过以下两种方案修改Dockerfile：

方案一：在final阶段直接安装PowerShell（适配Server Core镜像） #

多数dotnet/aspnet:6.0的Windows镜像基于Windows Server Core，可直接在final阶段添加PowerShell安装步骤：

FROM mcr.microsoft.com/dotnet/aspnet:6.0 AS base
WORKDIR /app
EXPOSE 80
EXPOSE 443

FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
WORKDIR /src
COPY ["somefiles", "dest_folder/"]

RUN dotnet restore "someapi/some_api.csproj"
COPY . .

WORKDIR "dir.Api"
RUN dotnet build "api.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "api.csproj" -c Release -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
# 安装PowerShell（针对Windows Server Core环境）
RUN powershell.exe -Command "Install-PackageProvider -Name NuGet -Force; Install-Module -Name PowerShellGet -Force"
# 若需启用系统自带PowerShell功能，可替换为以下命令
# RUN dism /online /enable-feature /featurename:MicrosoftWindowsPowerShell /all /norestart

COPY --from=publish /app/publish .
# 如需启动时先导入证书再启动API，可修改ENTRYPOINT为串联命令
# ENTRYPOINT ["powershell.exe", "-Command", "& { Import-PfxCertificate -FilePath 'certs/your-cert.pfx' -CertStoreLocation 'Cert:\\LocalMachine\\My'; dotnet SOZV.Api.dll }"]
ENTRYPOINT ["dotnet", "SOZV.Api.dll"]

方案二：切换至自带PowerShell的基础镜像 #

若默认dotnet/aspnet:6.0镜像缺失PowerShell，可直接选用包含PowerShell的Windows Server Core变体镜像：

# 使用带PowerShell的.NET 6 Windows Server Core镜像
FROM mcr.microsoft.com/dotnet/aspnet:6.0-windowsservercore-ltsc2022 AS base
WORKDIR /app
EXPOSE 80
EXPOSE 443

FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
WORKDIR /src
COPY ["somefiles", "dest_folder/"]

RUN dotnet restore "someapi/some_api.csproj"
COPY . .

WORKDIR "dir.Api"
RUN dotnet build "api.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "api.csproj" -c Release -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
# 可直接执行PowerShell命令导入证书
# 示例：导入PFX格式证书
# RUN powershell.exe -Command "Import-PfxCertificate -FilePath '/app/certs/your-cert.pfx' -CertStoreLocation 'Cert:\\LocalMachine\\My' -Password (ConvertTo-SecureString 'your-password' -AsPlainText -Force)"
ENTRYPOINT ["dotnet", "SOZV.Api.dll"]

核心注意事项 #

• 镜像变体区分：dotnet/aspnet:6.0的Windows镜像包含windowsservercore和nanoserver两种变体，Nano Server默认无PowerShell，需确保使用Server Core变体。
• 证书导入时机：若需动态导入证书，建议将导入命令与API启动命令串联执行，避免容器启动后仅完成证书导入而未启动服务。

内容的提问来源于stack exchange，提问作者HugoOlsen