Deploy .NET 8 Native AOT Microservices with Distroless Docker for Edge Computing

Why Native AOT is a game changer for edge microservices

Imagine a sensor hub that must start processing data in under 200 ms every time it powers on. Traditional .NET JIT compilation adds latency that can push startup beyond that window. .NET 8 Native AOT compiles IL directly to native machine code, shaving off 50‑70 % of startup time and reducing memory footprint by up to 80 % according to Microsoft benchmarks. For edge nodes that run on 256 MiB RAM and intermittent power, those savings translate into longer uptime and lower operating cost.

Beyond speed, Native AOT produces a single executable without the need for a runtime DLL tree. That simplicity aligns perfectly with distroless Docker images, which contain only the binary and its essential OS libraries. The result is a minimal attack surface and faster container pull times—critical when devices sit behind low‑bandwidth connections.

Preparing a .NET 8 project for Native AOT

Start with a .NET 8 console template that will later be containerized as a microservice. Add the Microsoft.NET.Native.Runtime.AOT package and enable AOT in the project file. The following

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFramework>net8.0</TargetFramework>
    <PublishAot>true</PublishAot>
    <SelfContained>true</SelfContained>
    <RuntimeIdentifier>linux-x64</RuntimeIdentifier>
  </PropertyGroup>
</Project>

When you run

dotnet publish -c Release -r linux-x64 --self-contained true /p:PublishAot=true

Building a Distroless Docker image

Google’s distroless base images omit shells, package managers, and even glibc where possible. For a .NET AOT binary you only need the gcr.io/distroless/base-debian11 image, which provides the minimal libc required by the compiled binary.

Create a Dockerfile that copies the published executable into the distroless layer:

<!-- Dockerfile for Native AOT -->
FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-alpine AS build
WORKDIR /src
COPY . .
RUN dotnet publish -c Release -r linux-x64 --self-contained true /p:PublishAot=true -o /app/publish

FROM gcr.io/distroless/base-debian11 AS final
WORKDIR /app
COPY --from=build /app/publish/MyEdgeService .
ENTRYPOINT ["./MyEdgeService"]

Note that the first stage uses the lightweight runtime-deps image only for the build step; the final stage contains nothing but the binary and the minimal OS libraries.

Deploying to edge devices

Edge devices often run on ARM64 CPUs. Adjust the RuntimeIdentifier to linux-arm64 and rebuild the image. Push the image to a registry reachable from the device, then pull and run it with a single command:

docker pull your-registry.io/edge-service:latest
docker run --restart unless-stopped --cpu-shares 512 --memory 256m your-registry.io/edge-service:latest

The --restart unless-stopped flag guarantees the service recovers after power loss, while the resource limits keep the container within the tight constraints of most edge gateways.

Performance tuning and monitoring

Even with AOT, you should profile cold‑start latency on the target hardware. Tools like perf or dotnet-counters can be run inside the container if you temporarily switch to a non‑distroless base for debugging. A practical tip: log the elapsed time from process start to the first HTTP response and emit it to stdout; Docker’s built‑in logging will capture the metric for centralized analysis.

Because the image contains no shell, you cannot exec into it for ad‑hoc debugging. Keep a “debug” tag that points to a similar Dockerfile based on mcr.microsoft.com/dotnet/runtime:8.0 with bash installed. Use that image only in staging environments.

Conclusion

Combining .NET 8 Native AOT with distroless Docker images delivers the smallest, fastest, and most secure containers for edge‑optimized microservices. The workflow—add AOT flags, publish a single executable, copy it into a distroless base, and enforce strict resource limits—fits into CI/CD pipelines with just a few extra lines of script. When you adopt this pattern, you can expect sub‑second cold starts, memory usage under 100 MiB, and a 30 % reduction in image size compared to traditional .NET Docker images.

Sources

Microsoft .NET Documentation – Native AOT
Google Cloud Distroless Documentation
Docker Official Blog – Optimizing Images for Edge Deployments

Author: Mahmut Sarıkaya — sarikayadev.com