Make container runtime health check conditional based on resource requirements

[Copilot]

Currently, the container runtime health check is performed unconditionally before building any images, even when no resources actually need the container runtime. This causes unnecessary errors when building applications that only contain .NET projects without Dockerfile-based containers.

This PR makes the health check conditional by:

1. Adding a helper method ResourcesRequireContainerRuntime that checks if any resources have both ContainerImageAnnotation and DockerfileBuildAnnotation
2. Modifying BuildImagesAsync to only perform the container runtime health check when resources actually need it
3. Adding comprehensive unit tests to validate the logic works correctly for all scenarios

Changes Made

• Only resources with DockerfileBuildAnnotation require the container runtime health check
• Project resources (built via dotnet publish /t:PublishContainer) don't require the health check
• Container resources without Dockerfile annotations don't require the health check
• Empty resource collections don't require the health check

Testing

Added unit tests covering:

• ✅ Project resources only (no health check needed)
• ✅ Dockerfile resources (health check required)
• ✅ Mixed resources (health check required)
• ✅ Empty resources (no health check needed)
• ✅ Container resources without Dockerfile (no health check needed)

This is a minimal, surgical change that prevents unnecessary container runtime health checks while maintaining all existing functionality.

Fixes #10392.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

• westus.data.mcr.microsoft.com
  • Triggering command: dotnet publish /home/REDACTED/work/aspire/aspire/tests/testproject/TestProject.ServiceA/TestProject.ServiceA.csproj --configuration Release /t:PublishContainer /p:ContainerRepository=servicea (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to my firewall allow list

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull Request Overview

This PR makes the container runtime health check in BuildImagesAsync conditional on whether any resources require a Dockerfile-based container build. It adds a helper method to detect those resources and includes unit tests covering several scenarios.

• Introduce ResourcesRequireContainerRuntime helper to detect resources with both container image and Dockerfile build annotations
• Guard the existing runtime health check in BuildImagesAsync so it only runs when needed
• Add unit tests for project-only, Dockerfile-only, mixed, empty, and container-without-Dockerfile cases

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/Aspire.Hosting/Publishing/ResourceContainerImageBuilder.cs	Wrap the health check call in an if and introduce the helper method
tests/Aspire.Hosting.Tests/Publishing/ResourceContainerImageBuilderTests.cs	Add tests and supporting mocks for ResourcesRequireContainerRuntime

Comments suppressed due to low confidence (2)

tests/Aspire.Hosting.Tests/Publishing/ResourceContainerImageBuilderTests.cs:385

• Consider adding a test case for a resource with only DockerfileBuildAnnotation (no ContainerImageAnnotation) to ensure ResourcesRequireContainerRuntime behaves as expected in that scenario.

    [Fact]

src/Aspire.Hosting/Publishing/ResourceContainerImageBuilder.cs:393

• The PR description states only DockerfileBuildAnnotation should trigger the health check, yet this implementation also requires ContainerImageAnnotation. Please clarify if both annotations are required or update the check to only look for DockerfileBuildAnnotation.

            resource.TryGetLastAnnotation<ContainerImageAnnotation>(out _) &&

[Copilot]

[nitpick] The test suite duplicates the logic of ResourcesRequireContainerRuntime. To reduce duplication and keep tests in sync, consider making the production helper internal (with an InternalsVisibleTo attribute) so tests can call it directly.

[eerhardt]

LGTM. Thanks for the fix!

[mitchdenny]

LGTM

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

• westcentralus.data.mcr.microsoft.com
  • Triggering command: buildkitd --allow-insecure-entitlement=network.host (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to my firewall allow list

[captainsafia]

/backport to release/9.4

[github-actions]

Started backporting to release/9.4: https://github.com/dotnet/aspire/actions/runs/16375400633