From 9c9d739f65020d4a2fec57992e0b7b422d9d0481 Mon Sep 17 00:00:00 2001
From: tangowithfoxtrot <5676771+tangowithfoxtrot@users.noreply.github.com>
Date: Thu, 13 Mar 2025 07:07:03 -0700
Subject: [PATCH] build: multi-stage builds

Co-authored-by: Vince Grassia <593223+vgrassia@users.noreply.github.com>
---
 bitwarden_license/src/Scim/Dockerfile | 73 +++++++++++++++++----
 bitwarden_license/src/Sso/Dockerfile  | 73 +++++++++++++++++----
 src/Admin/Dockerfile                  | 91 +++++++++++++++++++++++----
 src/Api/Dockerfile                    | 73 +++++++++++++++++----
 src/Events/Dockerfile                 | 68 ++++++++++++++++----
 src/Icons/Dockerfile                  | 69 ++++++++++++++++----
 src/Identity/Dockerfile               | 67 +++++++++++++++++---
 7 files changed, 433 insertions(+), 81 deletions(-)

diff --git a/bitwarden_license/src/Scim/Dockerfile b/bitwarden_license/src/Scim/Dockerfile
index d1bb11cf60..1d9ee6d946 100644
--- a/bitwarden_license/src/Scim/Dockerfile
+++ b/bitwarden_license/src/Scim/Dockerfile
@@ -1,19 +1,70 @@
-FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
-ARG TARGETPLATFORM
-ARG BUILDPLATFORM
+###############################################
+#                 Build stage                 #
+###############################################
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:8.0 AS build
 ENV PROJECT_NAME=Scim
 
-WORKDIR /build
-COPY ../../ ./
+# Docker buildx supplies the value for this arg
+ARG TARGETPLATFORM
 
-WORKDIR /build/bitwarden_license/src/${PROJECT_NAME}
+# Determine proper runtime value for .NET
+# We put the value in a file to be read by later layers.
+RUN if [ "$TARGETPLATFORM" = "linux/amd64" ]; then \
+      RID=linux-x64 ; \
+    elif [ "$TARGETPLATFORM" = "linux/arm64" ]; then \
+      RID=linux-arm64 ; \
+    elif [ "$TARGETPLATFORM" = "linux/arm/v7" ]; then \
+      RID=linux-arm ; \
+    fi \
+    && echo "RID=$RID" > /tmp/rid.txt
 
-RUN dotnet publish --self-contained /p:PublishSingleFile=true -o out
+WORKDIR /source
 
+# Copy csproj files as distinct layers
+COPY bitwarden_license/src/Scim/*.csproj ./bitwarden_license/src/Scim/
+COPY src/Core/*.csproj ./src/Core/
+COPY src/Infrastructure.Dapper/*.csproj ./src/Infrastructure.Dapper/
+COPY src/Infrastructure.EntityFramework/*.csproj ./src/Infrastructure.EntityFramework/
+COPY src/SharedWeb/*.csproj ./src/SharedWeb/
+COPY Directory.Build.props .
+
+# Restore project dependencies and tools
+WORKDIR /source/bitwarden_license/src/Scim
+RUN . /tmp/rid.txt && dotnet restore -r $RID
+
+WORKDIR /source/bitwarden_license/src/${PROJECT_NAME}
+
+# Copy required project files
+WORKDIR /source
+COPY .editorconfig /source
+COPY bitwarden_license/src/Scim/. ./bitwarden_license/src/Scim/
+COPY src/Core/. ./src/Core/
+COPY src/Infrastructure.Dapper/. ./src/Infrastructure.Dapper/
+COPY src/Infrastructure.EntityFramework/. ./src/Infrastructure.EntityFramework/
+COPY src/SharedWeb/. ./src/SharedWeb/
+COPY .git/. ./.git/
+
+# Build project
+WORKDIR /source/bitwarden_license/src/Scim
+RUN . /tmp/rid.txt && dotnet publish \
+  -c release \
+  --no-restore \
+  --self-contained \
+  /p:PublishSingleFile=true \
+  /p:SourceRevisionId="$GIT_COMMIT" \
+  -r $RID \
+  -o out
+
+WORKDIR /app
+
+###############################################
+#                  App stage                  #
+###############################################
 FROM mcr.microsoft.com/dotnet/aspnet:8.0
-
 LABEL com.bitwarden.product="bitwarden"
+EXPOSE 5000
 
+ENV ASPNETCORE_URLS=http://+:5000
 ENV PROJECT_NAME=Scim
 
 RUN apt-get update \
@@ -23,11 +74,9 @@ RUN apt-get update \
     krb5-user \
     && rm -rf /var/lib/apt/lists/*
 
-ENV ASPNETCORE_URLS=http://+:5000
-
-EXPOSE 5000
+# Copy app from the build stage
 WORKDIR /app
-COPY --from=build /build/bitwarden_license/src/${PROJECT_NAME}/out /app
+COPY --from=build /source/bitwarden_license/src/${PROJECT_NAME}/out /app
 COPY ./bitwarden_license/src/${PROJECT_NAME}/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
diff --git a/bitwarden_license/src/Sso/Dockerfile b/bitwarden_license/src/Sso/Dockerfile
index 39647d8b23..d4ee92b72d 100644
--- a/bitwarden_license/src/Sso/Dockerfile
+++ b/bitwarden_license/src/Sso/Dockerfile
@@ -1,19 +1,70 @@
-FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
-ARG TARGETPLATFORM
-ARG BUILDPLATFORM
+###############################################
+#                 Build stage                 #
+###############################################
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:8.0 AS build
 ENV PROJECT_NAME=Sso
 
-WORKDIR /build
-COPY ../../ ./
+# Docker buildx supplies the value for this arg
+ARG TARGETPLATFORM
 
-WORKDIR /build/bitwarden_license/src/${PROJECT_NAME}
+# Determine proper runtime value for .NET
+# We put the value in a file to be read by later layers.
+RUN if [ "$TARGETPLATFORM" = "linux/amd64" ]; then \
+      RID=linux-x64 ; \
+    elif [ "$TARGETPLATFORM" = "linux/arm64" ]; then \
+      RID=linux-arm64 ; \
+    elif [ "$TARGETPLATFORM" = "linux/arm/v7" ]; then \
+      RID=linux-arm ; \
+    fi \
+    && echo "RID=$RID" > /tmp/rid.txt
 
-RUN dotnet publish --self-contained /p:PublishSingleFile=true -o out
+WORKDIR /source
 
+# Copy csproj files as distinct layers
+COPY bitwarden_license/src/${PROJECT_NAME}/*.csproj ./bitwarden_license/src/${PROJECT_NAME}/
+COPY src/Core/*.csproj ./src/Core/
+COPY src/Infrastructure.Dapper/*.csproj ./src/Infrastructure.Dapper/
+COPY src/Infrastructure.EntityFramework/*.csproj ./src/Infrastructure.EntityFramework/
+COPY src/SharedWeb/*.csproj ./src/SharedWeb/
+COPY Directory.Build.props .
+
+# Restore project dependencies and tools
+WORKDIR /source/bitwarden_license/src/${PROJECT_NAME}
+RUN . /tmp/rid.txt && dotnet restore -r $RID
+
+WORKDIR /source/bitwarden_license/src/${PROJECT_NAME}
+
+# Copy required project files
+WORKDIR /source
+COPY .editorconfig /source
+COPY bitwarden_license/src/${PROJECT_NAME}/. ./bitwarden_license/src/${PROJECT_NAME}/
+COPY src/Core/. ./src/Core/
+COPY src/Infrastructure.Dapper/. ./src/Infrastructure.Dapper/
+COPY src/Infrastructure.EntityFramework/. ./src/Infrastructure.EntityFramework/
+COPY src/SharedWeb/. ./src/SharedWeb/
+COPY .git/. ./.git/
+
+# Build project
+WORKDIR /source/bitwarden_license/src/${PROJECT_NAME}
+RUN . /tmp/rid.txt && dotnet publish \
+  -c release \
+  --no-restore \
+  --self-contained \
+  /p:PublishSingleFile=true \
+  /p:SourceRevisionId="$GIT_COMMIT" \
+  -r $RID \
+  -o out
+
+WORKDIR /app
+
+###############################################
+#                  App stage                  #
+###############################################
 FROM mcr.microsoft.com/dotnet/aspnet:8.0
-
 LABEL com.bitwarden.product="bitwarden"
+EXPOSE 5000
 
+ENV ASPNETCORE_URLS=http://+:5000
 ENV PROJECT_NAME=Sso
 
 RUN apt-get update \
@@ -23,11 +74,9 @@ RUN apt-get update \
     krb5-user \
     && rm -rf /var/lib/apt/lists/*
 
-ENV ASPNETCORE_URLS=http://+:5000
-
-EXPOSE 5000
+# Copy app from the build stage
 WORKDIR /app
-COPY --from=build /build/bitwarden_license/src/${PROJECT_NAME}/out /app
+COPY --from=build /source/bitwarden_license/src/${PROJECT_NAME}/out /app
 COPY ./bitwarden_license/src/${PROJECT_NAME}/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
diff --git a/src/Admin/Dockerfile b/src/Admin/Dockerfile
index b54ca67435..8b6c4bab40 100644
--- a/src/Admin/Dockerfile
+++ b/src/Admin/Dockerfile
@@ -1,33 +1,102 @@
-FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
-ARG TARGETPLATFORM
-ARG BUILDPLATFORM
+###############################################
+#                 Build stage                 #
+###############################################
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:8.0 AS build
 ENV PROJECT_NAME=Admin
+ARG GIT_COMMIT
 
-WORKDIR /build
-COPY ../../ ./
+# Docker buildx supplies the value for this arg
+ARG TARGETPLATFORM
 
-WORKDIR /build/src/${PROJECT_NAME}
+# Determine proper runtime value for .NET
+RUN if [ "$TARGETPLATFORM" = "linux/amd64" ]; then \
+    RID=linux-x64 ; \
+    elif [ "$TARGETPLATFORM" = "linux/arm64" ]; then \
+    RID=linux-arm64 ; \
+    elif [ "$TARGETPLATFORM" = "linux/arm/v7" ]; then \
+    RID=linux-arm ; \
+    fi \
+    && echo "RID=$RID" > /tmp/rid.txt
 
-RUN dotnet publish --self-contained /p:PublishSingleFile=true -o out
+# Copy csproj files as distinct layers
+WORKDIR /source
+COPY src/${PROJECT_NAME}/*.csproj ./src/${PROJECT_NAME}/
+COPY src/Core/*.csproj ./src/Core/
+COPY src/Infrastructure.Dapper/*.csproj ./src/Infrastructure.Dapper/
+COPY src/Infrastructure.EntityFramework/*.csproj ./src/Infrastructure.EntityFramework/
+COPY src/SharedWeb/*.csproj ./src/SharedWeb/
+COPY util/Migrator/*.csproj ./util/Migrator/
+COPY util/MySqlMigrations/*.csproj ./util/MySqlMigrations/
+COPY util/PostgresMigrations/*.csproj ./util/PostgresMigrations/
+COPY util/SqliteMigrations/*.csproj ./util/SqliteMigrations/
+COPY bitwarden_license/src/Commercial.Core/*.csproj ./bitwarden_license/src/Commercial.Core/
+COPY bitwarden_license/src/Commercial.Infrastructure.EntityFramework/*.csproj ./bitwarden_license/src/Commercial.Infrastructure.EntityFramework/
+COPY Directory.Build.props .
 
+# Set up Node
+ARG NODE_VERSION=20
+RUN curl -fsSL https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - \
+    && apt-get update \
+    && apt-get install -y nodejs \
+    && npm install -g npm@latest && \
+    rm -rf /var/lib/apt/lists/*
+
+# Copying package.json, package-lock.json, and packages.lock.json
+WORKDIR /source/src/Admin
+COPY src/Admin/package*.json .
+RUN npm ci
+
+# Restore project dependencies and tools
+RUN . /tmp/rid.txt && dotnet restore -r $RID
+
+# Copy required project files
+WORKDIR /source
+COPY src/${PROJECT_NAME}/. ./src/${PROJECT_NAME}/
+COPY src/Core/. ./src/Core/
+COPY src/Infrastructure.Dapper/. ./src/Infrastructure.Dapper/
+COPY src/Infrastructure.EntityFramework/. ./src/Infrastructure.EntityFramework/
+COPY src/SharedWeb/. ./src/SharedWeb/
+COPY util/Migrator/. ./util/Migrator/
+COPY util/MySqlMigrations/. ./util/MySqlMigrations/
+COPY util/PostgresMigrations/. ./util/PostgresMigrations/
+COPY util/SqliteMigrations/. ./util/SqliteMigrations/
+COPY util/EfShared/. ./util/EfShared/
+COPY bitwarden_license/src/Commercial.Core/. ./bitwarden_license/src/Commercial.Core/
+COPY bitwarden_license/src/Commercial.Infrastructure.EntityFramework/. ./bitwarden_license/src/Commercial.Infrastructure.EntityFramework/
+COPY .git/. ./.git/
+COPY .editorconfig /source
+
+# Build project
+WORKDIR /source/src/${PROJECT_NAME}
+RUN npm run build
+RUN . /tmp/rid.txt && dotnet publish \
+    --self-contained \
+    /p:PublishSingleFile=true \
+    /p:SourceRevisionId="$GIT_COMMIT" \
+    -r $RID \
+    -o out
+
+###############################################
+#                  App stage                  #
+###############################################
 FROM mcr.microsoft.com/dotnet/aspnet:8.0
-
 LABEL com.bitwarden.product="bitwarden"
+EXPOSE 5000
 
+ENV ASPNETCORE_URLS=http://+:5000
 ENV PROJECT_NAME=Admin
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
     gosu \
     curl \
-    krb5-user \
     && rm -rf /var/lib/apt/lists/*
 
 ENV ASPNETCORE_URLS=http://+:5000
 
-EXPOSE 5000
+# Copy app from the build stage
 WORKDIR /app
-COPY --from=build /build/src/${PROJECT_NAME}/out /app
+COPY --from=build /source/src/${PROJECT_NAME}/out /app
 COPY ./src/${PROJECT_NAME}/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 HEALTHCHECK CMD curl -f http://localhost:5000/alive || exit 1
diff --git a/src/Api/Dockerfile b/src/Api/Dockerfile
index 0a6cfd8699..f0ad7b13f8 100644
--- a/src/Api/Dockerfile
+++ b/src/Api/Dockerfile
@@ -1,19 +1,70 @@
-FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
-ARG TARGETPLATFORM
-ARG BUILDPLATFORM
+###############################################
+#                 Build stage                 #
+###############################################
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:8.0 AS build
 ENV PROJECT_NAME=Api
+ARG GIT_COMMIT
 
-WORKDIR /build
-COPY ../../ ./
+# Docker buildx supplies the value for this arg
+ARG TARGETPLATFORM
 
-WORKDIR /build/src/${PROJECT_NAME}
+# Determine proper runtime value for .NET
+# We put the value in a file to be read by later layers.
+RUN if [ "$TARGETPLATFORM" = "linux/amd64" ]; then \
+    RID=linux-x64 ; \
+    elif [ "$TARGETPLATFORM" = "linux/arm64" ]; then \
+    RID=linux-arm64 ; \
+    elif [ "$TARGETPLATFORM" = "linux/arm/v7" ]; then \
+    RID=linux-arm ; \
+    fi \
+    && echo "RID=$RID" > /tmp/rid.txt
 
-RUN dotnet publish --self-contained /p:PublishSingleFile=true -o out
+# Copy csproj files as distinct layers
+WORKDIR /source
+COPY src/${PROJECT_NAME}/*.csproj ./src/${PROJECT_NAME}/
+COPY src/Core/*.csproj ./src/Core/
+COPY src/Infrastructure.Dapper/*.csproj ./src/Infrastructure.Dapper/
+COPY src/Infrastructure.EntityFramework/*.csproj ./src/Infrastructure.EntityFramework/
+COPY src/SharedWeb/*.csproj ./src/SharedWeb/
+COPY bitwarden_license/src/Commercial.Core/*.csproj ./bitwarden_license/src/Commercial.Core/
+COPY bitwarden_license/src/Commercial.Infrastructure.EntityFramework/*.csproj ./bitwarden_license/src/Commercial.Infrastructure.EntityFramework/
+COPY Directory.Build.props .
 
+# Restore project dependencies and tools
+WORKDIR /source/src/${PROJECT_NAME}
+RUN . /tmp/rid.txt && dotnet restore -r $RID
+
+# Copy required project files
+WORKDIR /source
+COPY src/${PROJECT_NAME}/. ./src/${PROJECT_NAME}/
+COPY src/Core/. ./src/Core/
+COPY src/Infrastructure.Dapper/. ./src/Infrastructure.Dapper/
+COPY src/Infrastructure.EntityFramework/. ./src/Infrastructure.EntityFramework/
+COPY src/SharedWeb/. ./src/SharedWeb/
+COPY bitwarden_license/src/Commercial.Core/. ./bitwarden_license/src/Commercial.Core/
+COPY bitwarden_license/src/Commercial.Infrastructure.EntityFramework/. ./bitwarden_license/src/Commercial.Infrastructure.EntityFramework/
+COPY .git/. ./.git/
+COPY .editorconfig /source
+
+# Build project
+WORKDIR /source/src/${PROJECT_NAME}
+RUN . /tmp/rid.txt && dotnet publish \
+    --self-contained \
+    /p:PublishSingleFile=true \
+    /p:SourceRevisionId="$GIT_COMMIT" \
+    -r $RID \
+    -o out
+
+WORKDIR /app
+
+###############################################
+#                  App stage                  #
+###############################################
 FROM mcr.microsoft.com/dotnet/aspnet:8.0
-
 LABEL com.bitwarden.product="bitwarden"
+EXPOSE 5000
 
+ENV ASPNETCORE_URLS=http://+:5000
 ENV PROJECT_NAME=Api
 
 RUN apt-get update \
@@ -23,11 +74,9 @@ RUN apt-get update \
     krb5-user \
     && rm -rf /var/lib/apt/lists/*
 
-ENV ASPNETCORE_URLS=http://+:5000
-
-EXPOSE 5000
+# Copy app from the build stage
 WORKDIR /app
-COPY --from=build /build/src/${PROJECT_NAME}/out /app
+COPY --from=build /source/src/${PROJECT_NAME}/out /app
 COPY ./src/${PROJECT_NAME}/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 HEALTHCHECK CMD curl -f http://localhost:5000/alive || exit 1
diff --git a/src/Events/Dockerfile b/src/Events/Dockerfile
index b9e2922d72..38db0f70ca 100644
--- a/src/Events/Dockerfile
+++ b/src/Events/Dockerfile
@@ -1,33 +1,79 @@
-FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
-ARG TARGETPLATFORM
-ARG BUILDPLATFORM
+###############################################
+#                 Build stage                 #
+###############################################
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:8.0 AS build
 ENV PROJECT_NAME=Events
+ARG GIT_COMMIT
 
-WORKDIR /build
-COPY ../../ ./
+# Docker buildx supplies the value for this arg
+ARG TARGETPLATFORM
 
-WORKDIR /build/src/${PROJECT_NAME}
+# Determine proper runtime value for .NET
+# We put the value in a file to be read by later layers.
+RUN if [ "$TARGETPLATFORM" = "linux/amd64" ]; then \
+  RID=linux-x64 ; \
+  elif [ "$TARGETPLATFORM" = "linux/arm64" ]; then \
+  RID=linux-arm64 ; \
+  elif [ "$TARGETPLATFORM" = "linux/arm/v7" ]; then \
+  RID=linux-arm ; \
+  fi \
+  && echo "RID=$RID" > /tmp/rid.txt
 
-RUN dotnet publish --self-contained /p:PublishSingleFile=true -o out
+# Copy csproj files as distinct layers
+WORKDIR /source
+COPY src/${PROJECT_NAME}/*.csproj ./src/${PROJECT_NAME}/
+COPY src/Core/*.csproj ./src/Core/
+COPY src/Infrastructure.Dapper/*.csproj ./src/Infrastructure.Dapper/
+COPY src/Infrastructure.EntityFramework/*.csproj ./src/Infrastructure.EntityFramework/
+COPY src/SharedWeb/*.csproj ./src/SharedWeb/
+COPY Directory.Build.props .
 
+# Restore project dependencies and tools
+WORKDIR /source/src/${PROJECT_NAME}
+RUN . /tmp/rid.txt && dotnet restore -r $RID
+
+# Copy required project files
+WORKDIR /source
+COPY src/${PROJECT_NAME}/. ./src/${PROJECT_NAME}/
+COPY src/Core/. ./src/Core/
+COPY src/Infrastructure.Dapper/. ./src/Infrastructure.Dapper/
+COPY src/Infrastructure.EntityFramework/. ./src/Infrastructure.EntityFramework/
+COPY src/SharedWeb/. ./src/SharedWeb/
+COPY .git/. ./.git/
+COPY .editorconfig /source
+
+# Build project
+WORKDIR /source/src/${PROJECT_NAME}
+RUN . /tmp/rid.txt && dotnet publish \
+  --self-contained \
+  /p:PublishSingleFile=true \
+  /p:SourceRevisionId="$GIT_COMMIT" \
+  -r $RID \
+  -o out
+
+WORKDIR /app
+
+###############################################
+#                  App stage                  #
+###############################################
 FROM mcr.microsoft.com/dotnet/aspnet:8.0
-
 LABEL com.bitwarden.product="bitwarden"
+EXPOSE 5000
 
+ENV ASPNETCORE_URLS=http://+:5000
 ENV PROJECT_NAME=Events
 
 RUN apt-get update \
   && apt-get install -y --no-install-recommends \
   gosu \
   curl \
-  krb5-user \
   && rm -rf /var/lib/apt/lists/*
 
 ENV ASPNETCORE_URLS=http://+:5000
 
-EXPOSE 5000
+# Copy app from the build stage
 WORKDIR /app
-COPY --from=build /build/src/${PROJECT_NAME}/out /app
+COPY --from=build /source/src/${PROJECT_NAME}/out /app
 COPY ./src/${PROJECT_NAME}/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 HEALTHCHECK CMD curl -f http://localhost:5000/alive || exit 1
diff --git a/src/Icons/Dockerfile b/src/Icons/Dockerfile
index b1b50d0e2b..ce74e33031 100644
--- a/src/Icons/Dockerfile
+++ b/src/Icons/Dockerfile
@@ -1,33 +1,76 @@
-FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
-ARG TARGETPLATFORM
-ARG BUILDPLATFORM
+###############################################
+#                 Build stage                 #
+###############################################
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:8.0 AS build
 ENV PROJECT_NAME=Icons
+ARG GIT_COMMIT
 
-WORKDIR /build
-COPY ../../ ./
+# Docker buildx supplies the value for this arg
+ARG TARGETPLATFORM
 
-WORKDIR /build/src/${PROJECT_NAME}
+# Determine proper runtime value for .NET
+RUN if [ "$TARGETPLATFORM" = "linux/amd64" ]; then \
+    RID=linux-x64 ; \
+    elif [ "$TARGETPLATFORM" = "linux/arm64" ]; then \
+    RID=linux-arm64 ; \
+    elif [ "$TARGETPLATFORM" = "linux/arm/v7" ]; then \
+    RID=linux-arm ; \
+    fi \
+    && echo "RID=$RID" > /tmp/rid.txt
 
-RUN dotnet publish --self-contained /p:PublishSingleFile=true -o out
+# Copy csproj files as distinct layers
+WORKDIR /source
+COPY src/${PROJECT_NAME}/*.csproj ./src/${PROJECT_NAME}/
+COPY src/Core/*.csproj ./src/Core/
+COPY src/Infrastructure.Dapper/*.csproj ./src/Infrastructure.Dapper/
+COPY src/Infrastructure.EntityFramework/*.csproj ./src/Infrastructure.EntityFramework/
+COPY src/SharedWeb/*.csproj ./src/SharedWeb/
+COPY Directory.Build.props .
 
+# Restore project dependencies and tools
+WORKDIR /source/src/${PROJECT_NAME}
+RUN . /tmp/rid.txt && dotnet restore -r $RID
+
+# Copy required project files
+WORKDIR /source
+COPY src/${PROJECT_NAME}/. ./src/${PROJECT_NAME}/
+COPY src/Core/. ./src/Core/
+COPY src/Infrastructure.Dapper/. ./src/Infrastructure.Dapper/
+COPY src/Infrastructure.EntityFramework/. ./src/Infrastructure.EntityFramework/
+COPY src/SharedWeb/. ./src/SharedWeb/
+COPY .git/. ./.git/
+COPY .editorconfig /source
+
+# Build project
+WORKDIR /source/src/${PROJECT_NAME}
+RUN . /tmp/rid.txt && dotnet publish \
+    --self-contained \
+    /p:PublishSingleFile=true \
+    /p:SourceRevisionId="$GIT_COMMIT" \
+    -r $RID \
+    -o out
+
+WORKDIR /app
+
+###############################################
+#                  App stage                  #
+###############################################
 FROM mcr.microsoft.com/dotnet/aspnet:8.0
-
 LABEL com.bitwarden.product="bitwarden"
+EXPOSE 5000
 
+ENV ASPNETCORE_URLS=http://+:5000
 ENV PROJECT_NAME=Icons
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
     gosu \
     curl \
-    krb5-user \
     && rm -rf /var/lib/apt/lists/*
 
-ENV ASPNETCORE_URLS=http://+:5000
-
-EXPOSE 5000
+# Copy app from the build stage
 WORKDIR /app
-COPY --from=build /build/src/${PROJECT_NAME}/out /app
+COPY --from=build /source/src/${PROJECT_NAME}/out /app
 COPY ./src/${PROJECT_NAME}/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 HEALTHCHECK CMD curl -f http://localhost:5000/google.com/icon.png || exit 1
diff --git a/src/Identity/Dockerfile b/src/Identity/Dockerfile
index c60d5b9dcd..133c4479fd 100644
--- a/src/Identity/Dockerfile
+++ b/src/Identity/Dockerfile
@@ -1,19 +1,66 @@
-FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
-ARG TARGETPLATFORM
-ARG BUILDPLATFORM
+###############################################
+#                 Build stage                 #
+###############################################
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:8.0 AS build
 ENV PROJECT_NAME=Identity
+ARG GIT_COMMIT
 
-WORKDIR /build
-COPY ../../ ./
+# Docker buildx supplies the value for this arg
+ARG TARGETPLATFORM
 
-WORKDIR /build/src/${PROJECT_NAME}
+# Determine proper runtime value for .NET
+# We put the value in a file to be read by later layers.
+RUN if [ "$TARGETPLATFORM" = "linux/amd64" ]; then \
+  RID=linux-x64 ; \
+  elif [ "$TARGETPLATFORM" = "linux/arm64" ]; then \
+  RID=linux-arm64 ; \
+  elif [ "$TARGETPLATFORM" = "linux/arm/v7" ]; then \
+  RID=linux-arm ; \
+  fi \
+  && echo "RID=$RID" > /tmp/rid.txt
 
-RUN dotnet publish --self-contained /p:PublishSingleFile=true -o out
+# Copy csproj files as distinct layers
+WORKDIR /source
+COPY src/${PROJECT_NAME}/*.csproj ./src/${PROJECT_NAME}/
+COPY src/Core/*.csproj ./src/Core/
+COPY src/Infrastructure.Dapper/*.csproj ./src/Infrastructure.Dapper/
+COPY src/Infrastructure.EntityFramework/*.csproj ./src/Infrastructure.EntityFramework/
+COPY src/SharedWeb/*.csproj ./src/SharedWeb/
+COPY Directory.Build.props .
 
+# Restore project dependencies and tools
+WORKDIR /source/src/${PROJECT_NAME}
+RUN . /tmp/rid.txt && dotnet restore -r $RID
+
+# Copy required project files
+WORKDIR /source
+COPY src/${PROJECT_NAME}/. ./src/${PROJECT_NAME}/
+COPY src/Core/. ./src/Core/
+COPY src/Infrastructure.Dapper/. ./src/Infrastructure.Dapper/
+COPY src/Infrastructure.EntityFramework/. ./src/Infrastructure.EntityFramework/
+COPY src/SharedWeb/. ./src/SharedWeb/
+COPY .git/. ./.git/
+COPY .editorconfig /source
+
+# Build project
+WORKDIR /source/src/${PROJECT_NAME}
+RUN . /tmp/rid.txt && dotnet publish \
+  --self-contained \
+  /p:PublishSingleFile=true \
+  /p:SourceRevisionId="$GIT_COMMIT" \
+  -r $RID \
+  -o out
+
+WORKDIR /app
+
+###############################################
+#                  App stage                  #
+###############################################
 FROM mcr.microsoft.com/dotnet/aspnet:8.0
-
 LABEL com.bitwarden.product="bitwarden"
+EXPOSE 5000
 
+ENV ASPNETCORE_URLS=http://+:5000
 ENV PROJECT_NAME=Identity
 
 RUN apt-get update \
@@ -25,9 +72,9 @@ RUN apt-get update \
 
 ENV ASPNETCORE_URLS=http://+:5000
 
-EXPOSE 5000
+# Copy app from the build stage
 WORKDIR /app
-COPY --from=build /build/src/${PROJECT_NAME}/out /app
+COPY --from=build /source/src/${PROJECT_NAME}/out /app
 COPY ./src/${PROJECT_NAME}/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 HEALTHCHECK CMD curl -f http://localhost:5000/.well-known/openid-configuration || exit 1