dotnet · lbussell · Jul 10, 2026 · Jun 10, 2026 · Jun 11, 2026 · Jun 11, 2026
@@ -4,6 +4,36 @@ All breaking changes and new features in `eng/docker-tools` will be documented i
 
 ---
 
+## 2026-06-11: Configurable per-registry referrer-lookup rate limit
+
+- Issue: [#2141](https://github.com/dotnet/docker-tools/issues/2141)
+
+ImageBuilder now rate limits only OCI referrer lookups (the ACR
+`/v2/<repo>/referrers/<digest>` endpoint), instead of throttling and bounding the concurrency of all
+ACR operations. All other ACR operations rely on the standard HTTP retry behavior, which retries on
+HTTP 429 and respects `Retry-After` headers. This significantly speeds up image copying during
+publishing.
+
+The referrer-lookup limit defaults to 250 requests per 60-second window and can be configured per
+registry via an optional `referrerRequestsPerMinute` field on each `RegistryAuthentication` entry in
+`publishConfig`:
+
+```yaml
+RegistryAuthentication:
+  - server: $(acr.server)
+    resourceGroup: $(acr.resourceGroup)
+    subscription: $(acr.subscription)
+    referrerRequestsPerMinute: 1000
+    serviceConnection:
+      name: $(publish.serviceConnectionName)
+      ...
+```
+
+This field is optional; when omitted, the 250/60s default is used. No action is required for
+existing configurations.
+
+---
+
 ## 2026-04-02: Extra Docker build options can be passed through ImageBuilder
 
 - Pull request: [#2063](https://github.com/dotnet/docker-tools/pull/2063)

@@ -143,6 +143,7 @@ Build Stage
               ▼
           Post_Build Stage
             ├── Merge image info files
+            ├── Create multi-arch manifests
             └── Consolidate SBOMs
                     │
                     ▼
@@ -191,13 +192,35 @@ Common patterns:
 - `"publish"` - Publish only (when re-running a failed publish from a previous build)
 - `"build,test,sign,publish"` - Full pipeline
 
-**Note:** The `Post_Build` stage is implicitly included whenever `build` is in the stages list. You don't need to specify it separately—it automatically runs after Build to merge image info files and consolidate SBOMs.
+**Note:** The `Post_Build` stage is implicitly included whenever `build` is in the stages list. You don't need to specify it separately—it automatically runs after Build to merge image info files, create and validate multi-arch manifests, and consolidate SBOMs.
 
 The stages variable is useful for:
 - Re-running just the publish stage after fixing a transient failure
 - Skipping tests during initial development
 - Running isolated stages for debugging
 
+### Decoupling build OS from the base image OS
+
+By default, a platform's `osVersion` represents the base image OS version, but also determines what
+build leg an image is built in. This can cause problems when build image and base image don't match
+up. For example, building a .NET app on Windows Server 2025 and copying the artifacts into a
+Windows Server 2019 base image won't work, because the build matrix generation will attempt to
+build the image on the Server 2019 build leg (which can't run Server 2025 images).
+
+To fix this, set the optional `buildOsVersion` field in order to override only the OS used in the
+build matrix generation. Here is an example of building a Windows Server 2019 image using Windows
+Server 2025:
+
+```jsonc
+{
+  // ...
+  "os": "windows",
+  "osVersion": "windowsservercore-ltsc2019",
+  "buildOsVersion": "windowsservercore-ltsc2025"
+  // ...
+}
+```
+
 ### Image Info Files: The Build's Memory
 
 Image info files (defined by [`ImageArtifactDetails`](https://github.com/dotnet/docker-tools/blob/main/src/ImageBuilder/Models/Image/ImageArtifactDetails.cs)) are the mechanism that tracks what was built:

@@ -15,6 +15,8 @@ parameters:
   customBuildInitSteps: []
   customTestInitSteps: []
   sourceBuildPipelineRunId: ""
+  # When true, the Post-Build stage runs even if the Build stage failed (succeededOrFailed).
+  runPostBuildOnFailure: false
 
   linuxAmdBuildJobTimeout: 60
   linuxArmBuildJobTimeout: 60
@@ -212,7 +214,10 @@ stages:
 ################################################################################
 - stage: Post_Build
   dependsOn: Build
-  condition: and(succeeded(), contains(variables['stages'], 'build'))
+  ${{ if eq(parameters.runPostBuildOnFailure, true) }}:
+    condition: and(succeededOrFailed(), contains(variables['stages'], 'build'))
+  ${{ else }}:
+    condition: and(succeeded(), contains(variables['stages'], 'build'))
   jobs:
   - template: /eng/docker-tools/templates/jobs/post-build.yml@self
     parameters:

@@ -21,6 +21,8 @@ parameters:
   # Build parameters
   noCache: false
   publishConfig: null
+  # When true, the Post-Build stage runs even if the Build stage failed.
+  runPostBuildOnFailure: false
   buildMatrixType: platformDependencyGraph
   buildMatrixCustomBuildLegGroupArgs: ""
   linuxAmdBuildJobTimeout: 60
@@ -47,6 +49,7 @@ stages:
   parameters:
     noCache: ${{ parameters.noCache }}
     publishConfig: ${{ parameters.publishConfig }}
+    runPostBuildOnFailure: ${{ parameters.runPostBuildOnFailure }}
     internalProjectName: ${{ parameters.internalProjectName }}
     publicProjectName: ${{ parameters.publicProjectName }}
     storageAccountServiceConnection: ${{ parameters.storageAccountServiceConnection }}

@@ -13,6 +13,8 @@ parameters:
   # Build parameters
   noCache: false
   publishConfig: null
+  # When true, the Post-Build stage runs even if the Build stage failed.
+  runPostBuildOnFailure: false
   buildMatrixType: platformDependencyGraph
   buildMatrixCustomBuildLegGroupArgs: ""
   linuxAmdBuildJobTimeout: 60
@@ -51,6 +53,7 @@ stages:
     # Build
     noCache: ${{ parameters.noCache }}
     publishConfig: ${{ parameters.publishConfig }}
+    runPostBuildOnFailure: ${{ parameters.runPostBuildOnFailure }}
     buildMatrixType: ${{ parameters.buildMatrixType }}
     buildMatrixCustomBuildLegGroupArgs: ${{ parameters.buildMatrixCustomBuildLegGroupArgs }}
     linuxAmdBuildJobTimeout: ${{ parameters.linuxAmdBuildJobTimeout }}

@@ -1,5 +1,5 @@
 variables:
-  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder:2996325
+  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder:3002630
   imageNames.imageBuilder: $(imageNames.imageBuilderName)
   imageNames.imageBuilder.withrepo: imagebuilder-withrepo:$(Build.BuildId)-$(System.JobId)
   imageNames.testRunner: mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux3.0-docker-testrunner

@@ -17,9 +17,7 @@
             VARIABLES[cat("sdk|", dotnetVersion, "|build-version")])) ^
     set isAlpine to find(OS_VERSION, "alpine") >= 0 ^
     set isWindows to find(OS_VERSION, "nanoserver") >= 0 || find(OS_VERSION, "windowsservercore") >= 0 ^
-    set lineContinuation to when(isWindows, "`", "\") ^
-
-    set includePowerShellRollForward to dotnetVersion != "8.0" && dotnetVersion != "9.0"
+    set lineContinuation to when(isWindows, "`", "\")
 }}ENV {{lineContinuation}}
     # Do not generate certificate
     DOTNET_GENERATE_ASPNET_CERTIFICATE=false {{lineContinuation}}
@@ -34,6 +32,4 @@
     # Skip extraction of XML docs - generally not useful within an image/container - helps performance
     NUGET_XMLDOC_MODE=skip {{if ARGS["include-powershell-vars"]:{{lineContinuation}}
     # PowerShell telemetry for docker image usage
-    POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-{{OS_ARCH_HYPHENATED}}{{if includePowerShellRollForward: {{lineContinuation}}
-    # Workaround for https://github.com/PowerShell/PowerShell/issues/20685
-    DOTNET_ROLL_FORWARD=Major}}}}
+    POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-{{OS_ARCH_HYPHENATED}}}}
@@ -7,24 +7,68 @@
     set isUbuntu to find(OS_ARCH_HYPHENATED, "Ubuntu") >= 0 ^
     set ubuntuVersion to when(find(OS_VERSION, "jammy") >= 0, "jammy", "noble") ^
 
+    _ Native AOT only requires gcc. Native AOT in .NET really only needs a linker and something to drive the linker.
+      The runtime falls back to using gcc to drive linking when clang is not present, and both use the same bfd linker
+      under the hood, so dropping clang/llvm meaningfully shrinks the image. This optimization was made in .NET 11,
+      hence the conditional below. ^
+    set useGcc to dotnetVersion != "8.0" && dotnetVersion != "9.0" && dotnetVersion != "10.0" ^
+
+    _ The gcc package alone isn't always sufficient to link Native AOT binaries:
+      - Alpine: gcc pulls in binutils, but musl-dev (crt objects/headers) must be added.
+      - Azure Linux 3.0: gcc pulls in neither binutils (objcopy/ld) nor glibc-devel
+        (crt objects and -ldl/-lrt), so both are added explicitly.
+      - Azure Linux 4.0 and Ubuntu: gcc transitively pulls in binutils and libc dev
+        packages, so gcc alone is enough.
+      Installing these specific packages avoids the much larger build-base /
+      build-essential meta-packages that bundle make, g++, autotools, etc. ^
+
     set pkgs to cat(sort(
-        when(isAlpine,
-        [
-            "build-base",
-            "clang",
-            "zlib-dev"
-        ],
-        when(isAzureLinux,
-        [
-            "build-essential",
-            "clang",
-            "zlib-devel"
-        ],
-        [
-            "clang",
-            "zlib1g-dev",
-            "llvm"
-        ]))))
+        when(
+            useGcc,
+            when(
+                isAlpine,
+                [
+                    "gcc",
+                    "musl-dev",
+                    "zlib-dev"
+                ],
+                when(
+                    isAzureLinux,
+                    [
+                        "binutils",
+                        "gcc",
+                        "glibc-devel",
+                        "zlib-devel"
+                    ],
+                    [
+                        "gcc",
+                        "zlib1g-dev"
+                    ]
+                )
+            ),
+            when(
+                isAlpine,
+                [
+                    "build-base",
+                    "clang",
+                    "zlib-dev"
+                ],
+                when(
+                    isAzureLinux,
+                    [
+                        "build-essential",
+                        "clang",
+                        "zlib-devel"
+                    ],
+                    [
+                        "clang",
+                        "zlib1g-dev",
+                        "llvm"
+                    ]
+                )
+            )
+        )
+    ))
 
 }}ARG REPO=mcr.microsoft.com/dotnet/sdk
 FROM {{baseImageTag}}

@@ -73,8 +73,8 @@ extends:
                   dotnet run --project eng/update-dependencies/update-dependencies.csproj --
                   from-channel
                   ${{ parameters.aspireChannel }}
-                  https://github.com/dotnet/aspire
-                  --version-source-name 'dotnet/aspire'
+                  https://github.com/microsoft/aspire
+                  --version-source-name 'microsoft/aspire'
                   ${{ parameters.gitHubAuthArgs }}
 
       - ${{ each tool in parameters.tools }}:

@@ -20,7 +20,7 @@ public static BuildRepo GetBuildRepo(this Build build)
         return repo switch
         {
             "https://github.com/dotnet/dotnet" or "https://dev.azure.com/dnceng/internal/_git/dotnet-dotnet" => BuildRepo.Vmr,
-            "https://github.com/dotnet/aspire" or "https://dev.azure.com/dnceng/internal/_git/dotnet-aspire" => BuildRepo.Aspire,
+            "https://github.com/microsoft/aspire" or "https://dev.azure.com/dnceng/internal/_git/microsoft-aspire" => BuildRepo.Aspire,
             _ => throw new InvalidOperationException($"Build {build.Id} was from unsupported repository '{repo}'"),
         };
     }

@@ -138,7 +138,7 @@ public static IEnumerable<IDependencyUpdater> CreateUpdaters(
             usedBuildInfos = [dependencyBuildInfos.First(info => info.SimpleName == _productName)];
 
             string baseUrl = ManifestHelper.GetBaseUrls(_manifestVariables.Variables, _options).First();
-            // Remove Aspire Dashboard case once https://github.com/dotnet/aspire/issues/2035 is fixed.
+            // Remove Aspire Dashboard case once https://github.com/microsoft/aspire/issues/2035 is fixed.
             string archiveExt = _os.Contains("win") || _productName.Contains("aspire-dashboard") ? "zip" : "tar.gz";
             string versionDir = _buildVersion ?? "";
             string versionFile = VersionHelper.ResolveProductVersion(versionDir, _options.StableBranding);

@@ -43,9 +43,10 @@ internal class PipelineArtifactProvider(
 
     private static readonly IEnumerable<PipelineArtifactFile> s_releaseConfigFiles =
     [
-        // Newest version of the staging pipeline
+        // Newest known location for release artifact data
+        new PipelineArtifactFile("manifests", "ReleaseConfig.json"),
+        // Older versions
         new PipelineArtifactFile("metadata", "ReleaseConfig.json"),
-        // Old version
         new PipelineArtifactFile("drop", "config.json"),
     ];
 

@@ -125,8 +125,8 @@
     "libssl|noble": "3t64",
     "libssl|resolute": "3t64",
 
-    "mingit|latest|x64|url": "https://github.com/git-for-windows/git/releases/download/v2.54.0.windows.1/MinGit-2.54.0-64-bit.zip",
-    "mingit|latest|x64|sha": "04f937e1f0918b17b9be6f2294cb2bb66e96e1d9832d1c298e2de088a1d0e668",
+    "mingit|latest|x64|url": "https://github.com/git-for-windows/git/releases/download/v2.55.0.windows.1/MinGit-2.55.0-64-bit.zip",
+    "mingit|latest|x64|sha": "31497e7968196332263459ee319d2524e3ebc5786ab895e2abad34ffdd4f4ebf",
     "mingit|8.0|x64|url": "$(mingit|latest|x64|url)",
     "mingit|8.0|x64|sha": "$(mingit|latest|x64|sha)",
     "mingit|9.0|x64|url": "$(mingit|latest|x64|url)",
@@ -175,19 +175,19 @@
     "monitor|10.0|base-url|checksums|main": "$(base-url|public-checksums|maintenance|main)",
     "monitor|10.0|base-url|checksums|nightly": "$(base-url|public-checksums|maintenance|nightly)",
 
-    "powershell|8.0|build-version": "7.4.16",
-    "powershell|8.0|Linux.Alpine|sha": "5b9f1362121a45fc06a89a58b28b66fff85fd1c1236e9df5e20f1eb44e6a480b01769874e88156972fd6b33719fa98fb7a6dae72073e37a2f87f6da1127d3988",
-    "powershell|8.0|Linux|arm32|sha": "f61674177ec9ee3557db3bbce669938a8e17e830634b310f93aada0b427aa8e2882a1fb4c2e3ac6f8246371753bc08c7f450a4fa8b6fe9bc96343767cda97405",
-    "powershell|8.0|Linux|arm64|sha": "fe29fe9126ada7cbf0b9aa4be4e80958268b7a1a5bc6dcd0f950d003af12a2c448672cd0d6081dab7fc6bd880eb1551ae06faad15e6210363c52e8ed5fd7b67c",
-    "powershell|8.0|Linux|x64|sha": "446e83a1a293be84f22b9a0a9243961caae33a7032a4e00a11434cf44aa546855174b5336efee284cb8d88a416e8f59145f3cd43aff8d7bf5939e079b7e2e3a4",
-    "powershell|8.0|Windows|x64|sha": "5eedf11e4a54937713067e0796de3bf165afca0ad4002578ddd92fccbec37ebd70efd23160bfe7d9b6cb9c15b7afcc3c4635955112a950fb9b70fd8c1a9eb4df",
+    "powershell|8.0|build-version": "7.4.17",
+    "powershell|8.0|Linux.Alpine|sha": "2653ecb7c4423f5530f9847a47909a34692c36db9311e97d4b10f92af82d87943593762d8107cd27c4cc0cbaebb34c2919fe2e00302172f00a8cb6d5f84e8927",
+    "powershell|8.0|Linux|arm32|sha": "1fa6e803011747cd98feac935e694823a682d6285f9155b5cd4abc30fec0368cf35568776212d3039c36d3f43da4e866b28126766ecf28e0e6cc38b59612ea9c",
+    "powershell|8.0|Linux|arm64|sha": "83b7e6dcea9b235b3f2f87c98704746583a3403f7590f06f04483fd26a16b893930f35d17862ee7fdc6d189b3b069ba8b7b97d79d479124362687c0e8840da55",
+    "powershell|8.0|Linux|x64|sha": "e278f58ec3b86c2857dee5711d3d3d7f39b3a1ac0a732d3d0e6d9293fbfce246bbf1d24fd314a62d760a27e2664fdd3a5a44a1c61f1c1613cc8691602157b576",
+    "powershell|8.0|Windows|x64|sha": "b99fbfd7370a49bee61b4635d4158917089682fa021c7e9e219d747f1a7a33e893027195947688cfbe0caaa641360ab53ec919d8a5ba152ab29d23b4ecbe7dd4",
 
-    "powershell|9.0|build-version": "7.5.7",
-    "powershell|9.0|Linux.Alpine|sha": "c672bac9f736e794cd586195c87fcb6f26468cc49c1ec835cfcf25c79daeaef934b5d92bc0ce092cd02cc0a5b8d933e94dead0aa850a7b7f77afbec8338331fd",
-    "powershell|9.0|Linux|arm32|sha": "4fdfe99c4e27dffccf4550a2571fba0bdf630a92bfe39c4b2af1ed0adad5ffe19e50df3eed1ed4bb18d88e7c7e26e2d1e1f41c164049f819aa1266b9b4a72db1",
-    "powershell|9.0|Linux|arm64|sha": "b06e7a36b359fd10bfe86259849d5bcfebcc1d107578ac1135f899a3fe701a5e486475fce3bbe249c86def733848093662efe953e5851410a90dc90888ef5d95",
-    "powershell|9.0|Linux|x64|sha": "a39f82dd75d697a1b004235d3c699636dce009196cec91b7d1a5cb4be6e260e178da4a37071598cfceda0c03bf1faaf0a557b88ec801a7fdc2ea6be2b6a82b08",
-    "powershell|9.0|Windows|x64|sha": "e4ecdafdfdda73c6df53a7eb8da6929a71539d2df2ac204a6e7a870b118e28609f0d6a281411b5ce46c23899c650737eaf3681087cd0751be5d658bc8cfb25e8",
+    "powershell|9.0|build-version": "7.5.8",
+    "powershell|9.0|Linux.Alpine|sha": "b98caef3b68bb6b85c3b1cfad9d783b91d2e1b01e2e74502e2e1a6b33bbca92c0613b77aee45db95daeb7868266472cbe4bafc505904abe3852481c3b776b30f",
+    "powershell|9.0|Linux|arm32|sha": "e63f22b5402ddb8a480d708c7d7a0aeee5e8edc24a683e5d4fe64ed6c2aa106e9c6917185ab8a97a156598759c9028535c564fdc53967bed33d11ef4d753b712",
+    "powershell|9.0|Linux|arm64|sha": "5b972bda947d4762974ecdde770e4f8bb55deab6b8ae2e04d9d25e17662670432bbecceab7fcc584fa01e34dab355bbb58bc156a2cecfab9931030baa172f6bc",
+    "powershell|9.0|Linux|x64|sha": "2ab1face06a1da3ab3fc26ead6deb0e6b28c24438b606f10101c00099a12f5af38ffcbab00a9160669f4c9c85e5b48bf818e72ccf6a5316353562480537c87c4",
+    "powershell|9.0|Windows|x64|sha": "e4d0c535601f6ab5d671ad0a2fea967183e54794cb39027d1cf296eac8ec4c80b550e2d5d620ee00dbb29d800026ee3b103441b0018af92240902849d16f9c8b",
 
     "powershell|10.0|build-version": "7.6.2",
     "powershell|10.0|Linux.Alpine|sha": "a6f152b23c3ab16676f173fc61d532b5853ccc92715cbcef02c2ffb92172e18d28a11b11b0bea0a939bb5d543e197cdce3c1162bc4a52ad96d91c6fe6664f830",
@@ -258,7 +258,7 @@
     "sdk|11.0|minor-tag": "$(dotnet|11.0|minor-tag)",
 
     "syft|repo": "anchore/syft",
-    "syft|version": "v1.44.0",
+    "syft|version": "v1.45.1",
     "syft|tag": "$(syft|version)-debug"
   }
 }
@@ -32,9 +32,7 @@ ENV \
     # Skip extraction of XML docs - generally not useful within an image/container - helps performance
     NUGET_XMLDOC_MODE=skip \
     # PowerShell telemetry for docker image usage
-    POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Alpine-3.23 \
-    # Workaround for https://github.com/PowerShell/PowerShell/issues/20685
-    DOTNET_ROLL_FORWARD=Major
+    POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Alpine-3.23
 
 RUN apk add --upgrade --no-cache \
         curl \

@@ -32,9 +32,7 @@ ENV \
     # Skip extraction of XML docs - generally not useful within an image/container - helps performance
     NUGET_XMLDOC_MODE=skip \
     # PowerShell telemetry for docker image usage
-    POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Alpine-3.24 \
-    # Workaround for https://github.com/PowerShell/PowerShell/issues/20685
-    DOTNET_ROLL_FORWARD=Major
+    POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Alpine-3.24
 
 RUN apk add --upgrade --no-cache \
         curl \

@@ -34,9 +34,7 @@ ENV \
     # Skip extraction of XML docs - generally not useful within an image/container - helps performance
     NUGET_XMLDOC_MODE=skip \
     # PowerShell telemetry for docker image usage
-    POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Azure-Linux-3.0 \
-    # Workaround for https://github.com/PowerShell/PowerShell/issues/20685
-    DOTNET_ROLL_FORWARD=Major
+    POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Azure-Linux-3.0
 
 RUN tdnf install -y \
         git \

@@ -34,9 +34,7 @@ ENV \
     # Skip extraction of XML docs - generally not useful within an image/container - helps performance
     NUGET_XMLDOC_MODE=skip \
     # PowerShell telemetry for docker image usage
-    POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Azure-Linux-3.0-arm64 \
-    # Workaround for https://github.com/PowerShell/PowerShell/issues/20685
-    DOTNET_ROLL_FORWARD=Major
+    POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Azure-Linux-3.0-arm64
 
 RUN tdnf install -y \
         git \