From 1d8470f54b8879743f9c743f0fda6a7cf9a0ef6e Mon Sep 17 00:00:00 2001
From: "net-containers-bot[bot]"
 <307772199+net-containers-bot[bot]@users.noreply.github.com>
Date: Fri, 31 Jul 2026 19:36:43 +0000
Subject: [PATCH 1/8] Update common Docker engineering infrastructure from
 mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:ec9d58ce2f6926c5a3cc8ec56e8a612143c9c35bdba1f2cd5615d3d7a91c9287

---
 eng/docker-tools/DEV-GUIDE.md                 |   8 +-
 eng/docker-tools/Update-ImageBuilder.ps1      |  89 +++++++++++++++
 .../stages/setup-service-connections.yml      |  68 -----------
 .../templates/steps/init-docker-linux.yml     | 108 ------------------
 .../templates/steps/init-docker-windows.yml   |  55 ---------
 .../steps/init-matrix-build-publish.yml       |  78 -------------
 .../templates/variables/docker-images.yml     |   2 +-
 7 files changed, 93 insertions(+), 315 deletions(-)
 create mode 100644 eng/docker-tools/Update-ImageBuilder.ps1
 delete mode 100644 eng/docker-tools/templates/stages/setup-service-connections.yml
 delete mode 100644 eng/docker-tools/templates/steps/init-docker-linux.yml
 delete mode 100644 eng/docker-tools/templates/steps/init-docker-windows.yml
 delete mode 100644 eng/docker-tools/templates/steps/init-matrix-build-publish.yml

diff --git a/eng/docker-tools/DEV-GUIDE.md b/eng/docker-tools/DEV-GUIDE.md
index d47fb3ebda..9d4eaee7c4 100644
--- a/eng/docker-tools/DEV-GUIDE.md
+++ b/eng/docker-tools/DEV-GUIDE.md
@@ -352,12 +352,10 @@ The system has built-in retry logic but requires manual intervention after repea
 
 Once you've fixed the underlying problem (Dockerfile change, test fix, etc.) and have a successful build:
 
-1. Navigate to the successful pipeline run in Azure DevOps
-2. Add the `autobuilder` label to that run
-3. This signals to the infrastructure that a successful build has occurred
-4. The system will resume automatic rebuilds for that image as needed
+1. Manually queue a build for the affected image paths
+2. After the build succeeds, the system will resume automatic rebuilds for that image as needed
 
-The `autobuilder` label is how the infrastructure tracks that the failure cycle has been broken and normal operations can resume.
+The infrastructure considers the three most recent pipeline runs, so any successful run breaks the failure cycle.
 
 ---
 
diff --git a/eng/docker-tools/Update-ImageBuilder.ps1 b/eng/docker-tools/Update-ImageBuilder.ps1
new file mode 100644
index 0000000000..88f0361c7f
--- /dev/null
+++ b/eng/docker-tools/Update-ImageBuilder.ps1
@@ -0,0 +1,89 @@
+#!/usr/bin/env pwsh
+
+<#
+.SYNOPSIS
+Example script that updates the bundled docker-tools infrastructure in the current repo to a specific
+ImageBuilder image.
+
+.DESCRIPTION
+ImageBuilder ships a copy of the eng/docker-tools infrastructure and writes it back to disk via its
+'update' command. The reference that 'update' records into
+eng/docker-tools/templates/variables/docker-images.yml is supplied as an argument rather than being
+baked into the build, so the caller decides exactly which image the repo should pin to.
+
+This example resolves the multi-platform (manifest list / image index) digest of an ImageBuilder image
+(the published 'latest' tag by default) and passes that digest reference to the 'update' command, which
+runs inside the same image with the repository mounted so it can rewrite eng/docker-tools on disk.
+
+.PARAMETER ImageBuilderImage
+The ImageBuilder image to resolve and run. Defaults to the published 'latest' tag.
+
+.PARAMETER RepoRoot
+The root of the git repository to update. Defaults to the current directory.
+
+.NOTES
+To exercise an unpublished ImageBuilder (for example, the 'update' command before it is released),
+build the image, push it to a registry it can be pulled from, and pass its reference via
+-ImageBuilderImage. The digest is read from the registry, so the image must be pushed first.
+#>
+[CmdletBinding()]
+param(
+    [string]
+    $ImageBuilderImage = "mcr.microsoft.com/dotnet-buildtools/image-builder:latest",
+
+    [string]
+    $RepoRoot = (Get-Location).Path
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+function Exec {
+    param ([string] $Cmd)
+
+    Write-Output "Executing: '$Cmd'"
+    Invoke-Expression $Cmd
+    if ($LASTEXITCODE -ne 0) {
+        throw "Failed: '$Cmd'"
+    }
+}
+
+# Strip any existing tag or digest so the resolved digest can be appended to the bare repository name.
+# A tag is a ':' within the final path segment; a registry host's ':port' precedes the last '/', so it
+# must not be mistaken for a tag.
+function Get-RepositoryName {
+    param ([string] $Reference)
+
+    $withoutDigest = $Reference.Split('@')[0]
+    $lastSlash = $withoutDigest.LastIndexOf('/')
+    $lastColon = $withoutDigest.LastIndexOf(':')
+    if ($lastColon -gt $lastSlash) {
+        return $withoutDigest.Substring(0, $lastColon)
+    }
+
+    return $withoutDigest
+}
+
+# Resolve the multi-platform digest. 'docker buildx imagetools inspect' reads the top-level manifest
+# straight from the registry, so for a multi-arch image this is the manifest list (image index) digest
+# rather than a single platform's digest. Pinning the index keeps the reference valid on every
+# platform the pipeline runs on.
+$digest = (docker buildx imagetools inspect $ImageBuilderImage --format '{{.Manifest.Digest}}')
+if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($digest)) {
+    throw "Unable to resolve a multi-platform digest for '$ImageBuilderImage'."
+}
+
+$repository = Get-RepositoryName $ImageBuilderImage
+$imageBuilderRef = "$repository@$($digest.Trim())"
+
+Write-Output "Resolved ImageBuilder reference: $imageBuilderRef"
+
+# Run 'update' from the resolved digest, mounting the repository so it can write eng/docker-tools to
+# disk. The command must run from the repository root, which is why $RepoRoot is the mounted working
+# directory. Running by the same digest that gets recorded keeps the writer and the pinned reference
+# identical.
+Exec ("docker run --rm " `
+    + "-v `"${RepoRoot}:/repo`" " `
+    + "-w /repo " `
+    + "$imageBuilderRef " `
+    + "update $imageBuilderRef")
diff --git a/eng/docker-tools/templates/stages/setup-service-connections.yml b/eng/docker-tools/templates/stages/setup-service-connections.yml
deleted file mode 100644
index 405bc703ac..0000000000
--- a/eng/docker-tools/templates/stages/setup-service-connections.yml
+++ /dev/null
@@ -1,68 +0,0 @@
-# This stage exists to tell Azure DevOps about all of the service connections
-# that will be used in the pipeline. A service connection will not work unless
-# it is declared in this stage's parameters, even if your pipeline has already
-# been granted access to the service connection. This stage also does not need
-# to complete before the service connection is used.
-#
-# There are two ways to specify service connections:
-# - Pass `serviceConnections` directly (list of {name: string} objects)
-# - Pass `publishConfig` + `registries` to look up auth from RegistryAuthentication
-parameters:
-- name: pool
-  type: object
-  default:
-    name: $(default1ESInternalPoolName)
-    image: $(default1ESInternalPoolImage)
-    os: linux
-
-# Explicit list of service connections to initialize
-# Shape: [{ name: string }]
-- name: serviceConnections
-  type: object
-  default: []
-
-# List of registry servers that need authentication. These will be looked up in
-# publishConfig.RegistryAuthentication.
-# Make sure to provide the publishConfig parameter.
-- name: usesRegistries
-  type: object
-  default: []
-# Look up service connections from publishConfig based on registries
-# The publish configuration containing RegistryAuthentication entries.
-- name: publishConfig
-  type: object
-  default: {}
-
-stages:
-- stage: SetupServiceConnectionsStage
-  displayName: Setup service connections
-  jobs:
-
-  - job: SetupServiceConnectionsJob
-    displayName: Setup service connections
-    pool: ${{ parameters.pool }}
-    steps:
-    - checkout: none
-
-    # Direct service connections list
-    - ${{ each serviceConnection in parameters.serviceConnections }}:
-      - task: AzureCLI@2
-        displayName: Setup ${{ serviceConnection.name }}
-        inputs:
-          azureSubscription: ${{ serviceConnection.name }}
-          scriptType: pscore
-          scriptLocation: inlineScript
-          inlineScript: |
-            az account show
-
-    # Setup registry service connections
-    - ${{ if gt(length(parameters.usesRegistries), 0) }}:
-      - ${{ each auth in parameters.publishConfig.RegistryAuthentication }}:
-        - ${{ if containsValue(parameters.usesRegistries, auth.server) }}:
-          - task: AzureCLI@2
-            displayName: Setup ${{ auth.serviceConnection.name }}
-            inputs:
-              azureSubscription: ${{ auth.serviceConnection.name }}
-              scriptType: pscore
-              scriptLocation: inlineScript
-              inlineScript: az account show
diff --git a/eng/docker-tools/templates/steps/init-docker-linux.yml b/eng/docker-tools/templates/steps/init-docker-linux.yml
deleted file mode 100644
index 3216afdb8e..0000000000
--- a/eng/docker-tools/templates/steps/init-docker-linux.yml
+++ /dev/null
@@ -1,108 +0,0 @@
-parameters:
-- name: setupImageBuilder
-  type: boolean
-  default: true
-- name: setupTestRunner
-  type: boolean
-  default: false
-# Whether existing Docker images will be deleted
-- name: cleanupDocker
-  type: boolean
-  default: false
-# Whether or not to run the steps in this template
-- name: condition
-  type: string
-  default: "true"
-- name: publishConfig
-  type: object
-  default: null
-
-steps:
-- template: /eng/docker-tools/templates/steps/init-common.yml@self
-  parameters:
-    condition: ${{ parameters.condition }}
-- script: echo "##vso[task.setvariable variable=artifactsPath]/artifacts"
-  displayName: Define Artifacts Path Variable
-  condition: and(succeeded(), ${{ parameters.condition }})
-
-  ################################################################################
-  # Cleanup Docker Resources
-  ################################################################################
-- ${{ if eq(parameters.cleanupDocker, 'true') }}:
-  - template: /eng/docker-tools/templates/steps/cleanup-docker-linux.yml@self
-    parameters:
-      condition: ${{ parameters.condition }}
-
-  ################################################################################
-  # Setup Image Builder (Optional)
-  ################################################################################
-- ${{ if eq(parameters.setupImageBuilder, 'true') }}:
-
-  - powershell: $(engDockerToolsPath)/Pull-Image.ps1 $(imageNames.imageBuilder)
-    displayName: Pull Image Builder
-    condition: and(succeeded(), ${{ parameters.condition }})
-
-  - template: /eng/docker-tools/templates/steps/generate-appsettings.yml@self
-    parameters:
-      publishConfig: ${{ parameters.publishConfig }}
-      condition: ${{ parameters.condition }}
-
-  - script: >-
-      docker build
-      -t $(imageNames.imageBuilder.withrepo)
-      --build-arg IMAGE=$(imageNames.imageBuilder)
-      -f $(engDockerToolsPath)/Dockerfile.WithRepo .
-    displayName: Build Image for Image Builder
-    condition: and(succeeded(), ${{ parameters.condition }})
-
-  - task: PowerShell@2
-    displayName: Define ImageBuilder Command Variables
-    condition: and(succeeded(), ${{ parameters.condition }})
-    inputs:
-      targetType: 'inline'
-      script: |
-        $imageBuilderImageName = "$(imageNames.imageBuilder.withrepo)"
-        Write-Host "##vso[task.setvariable variable=imageBuilderImageName]$imageBuilderImageName"
-
-        $dockerRunBaseCmd = @(
-          "docker run --rm"
-        )
-
-        $dockerRunArgs = @(
-          "-v /var/run/docker.sock:/var/run/docker.sock"
-          "-v $(Build.ArtifactStagingDirectory):$(artifactsPath)"
-          "-w /repo"
-          "$(imageBuilderDockerRunExtraOptions)"
-          "$(imageNames.imageBuilder.withrepo)"
-        )
-
-        $authedDockerRunArgs = @(
-          '-e'
-          'SYSTEM_ACCESSTOKEN=$env:SYSTEM_ACCESSTOKEN'
-          '-e'
-          'SYSTEM_OIDCREQUESTURI=$env:SYSTEM_OIDCREQUESTURI'
-        )
-
-        $dockerRunCmd = $dockerRunBaseCmd + $dockerRunArgs
-        $authedDockerRunCmd = $dockerRunBaseCmd + $authedDockerRunArgs + $dockerRunArgs
-
-        $runImageBuilderCmd = $($dockerRunCmd -join ' ')
-        $runAuthedImageBuilderCmd = $($authedDockerRunCmd -join ' ')
-
-        Write-Host "##vso[task.setvariable variable=runImageBuilderCmd]$runImageBuilderCmd"
-        Write-Host "##vso[task.setvariable variable=runAuthedImageBuilderCmd]$runAuthedImageBuilderCmd"
-
-  ################################################################################
-  # Setup Test Runner (Optional)
-  ################################################################################
-- ${{ if eq(parameters.setupTestRunner, 'true') }}:
-  - powershell: $(engDockerToolsPath)/Pull-Image.ps1 $(imageNames.testrunner)
-    displayName: Pull Test Runner
-    condition: and(succeeded(), ${{ parameters.condition }})
-  - script: >
-      docker build
-      -t $(imageNames.testRunner.withrepo)
-      --build-arg IMAGE=$(imageNames.testrunner)
-      -f $(engDockerToolsPath)/Dockerfile.WithRepo .
-    displayName: Build Test Runner Image
-    condition: and(succeeded(), ${{ parameters.condition }})
diff --git a/eng/docker-tools/templates/steps/init-docker-windows.yml b/eng/docker-tools/templates/steps/init-docker-windows.yml
deleted file mode 100644
index 36bd8e6df5..0000000000
--- a/eng/docker-tools/templates/steps/init-docker-windows.yml
+++ /dev/null
@@ -1,55 +0,0 @@
-parameters:
-  setupImageBuilder: true
-  condition: "true"
-  publishConfig: null
-
-steps:
-- template: /eng/docker-tools/templates/steps/init-common.yml@self
-  parameters:
-    condition: ${{ parameters.condition }}
-- powershell: echo "##vso[task.setvariable variable=artifactsPath]$(Build.ArtifactStagingDirectory)"
-  displayName: Define Artifacts Path Variable
-  condition: and(succeeded(), ${{ parameters.condition }})
-
-  ################################################################################
-  # Cleanup Docker Resources
-  ################################################################################
-- template: /eng/docker-tools/templates/steps/cleanup-docker-windows.yml@self
-  parameters:
-    condition: ${{ parameters.condition }}
-
-  ################################################################################
-  # Setup Image Builder (Optional)
-  ################################################################################
-- ${{ if eq(parameters.setupImageBuilder, 'true') }}:
-  - powershell: $(engDockerToolsPath)/Invoke-WithRetry.ps1 "docker pull $(imageNames.imageBuilder)"
-    displayName: Pull Image Builder
-    condition: and(succeeded(), ${{ parameters.condition }})
-  - script: docker create --name setupImageBuilder-$(Build.BuildId)-$(System.JobId) $(imageNames.imageBuilder)
-    displayName: Create Setup Container
-    condition: and(succeeded(), ${{ parameters.condition }})
-  - script: >
-      docker cp
-      setupImageBuilder-$(Build.BuildId)-$(System.JobId):/image-builder
-      $(Build.BinariesDirectory)/.Microsoft.DotNet.ImageBuilder
-    displayName: Copy Image Builder
-    condition: and(succeeded(), ${{ parameters.condition }})
-  - script: docker rm -f setupImageBuilder-$(Build.BuildId)-$(System.JobId)
-    displayName: Cleanup Setup Container
-    condition: and(always(), ${{ parameters.condition }})
-    continueOnError: true
-
-  - template: /eng/docker-tools/templates/steps/generate-appsettings.yml@self
-    parameters:
-      publishConfig: ${{ parameters.publishConfig }}
-      condition: ${{ parameters.condition }}
-
-  - task: PowerShell@2
-    displayName: Define runImageBuilderCmd Variables
-    condition: and(succeeded(), ${{ parameters.condition }})
-    inputs:
-      targetType: 'inline'
-      script: |
-        $runImageBuilderCmd = "$(Build.BinariesDirectory)\.Microsoft.DotNet.ImageBuilder\Microsoft.DotNet.ImageBuilder.exe"
-        Write-Host "##vso[task.setvariable variable=runImageBuilderCmd]$runImageBuilderCmd"
-        Write-Host "##vso[task.setvariable variable=runAuthedImageBuilderCmd]$runImageBuilderCmd"
diff --git a/eng/docker-tools/templates/steps/init-matrix-build-publish.yml b/eng/docker-tools/templates/steps/init-matrix-build-publish.yml
deleted file mode 100644
index e5e6bf19ce..0000000000
--- a/eng/docker-tools/templates/steps/init-matrix-build-publish.yml
+++ /dev/null
@@ -1,78 +0,0 @@
-# Initialize common variables used in
-# - Generating build matrix
-# - Building images
-# - Running tests
-# - Publishing images
-
-parameters:
-  publishConfig: null
-  versionsRepoRef: ""
-  versionsRepoPath: "versions"
-
-steps:
-- checkout: self
-- ${{ if ne(parameters.versionsRepoRef, '') }}:
-  - checkout: ${{ parameters.versionsRepoRef }}
-    path: s/${{ parameters.versionsRepoPath }}
-    persistCredentials: true
-    fetchDepth: 1
-    condition: succeeded()
-- powershell: |
-    $commonMatrixAndBuildOptions = "--source-repo $(publicGitRepoUri)"
-    if ("$(System.TeamProject)" -eq "internal" -and "$(Build.Reason)" -ne "PullRequest") {
-      $commonMatrixAndBuildOptions = "$commonMatrixAndBuildOptions --source-repo-prefix ${{ parameters.publishConfig.InternalMirrorRegistry.repoPrefix }} --registry-override ${{ parameters.publishConfig.BuildRegistry.server }}"
-    }
-
-    if ("$(System.TeamProject)" -eq "public" -and "$(public-mirror.server)" -ne "") {
-      $commonMatrixAndBuildOptions = "$commonMatrixAndBuildOptions --base-override-regex '^(?!mcr\.microsoft\.com)' --base-override-sub '$(public-mirror.server)/'"
-    }
-
-    if ("${{ parameters.versionsRepoRef }}" -ne "") {
-      $versionsBasePath = "${{ parameters.versionsRepoPath }}/"
-      $pipelineDisabledCache = "false"
-
-      $pathSeparatorIndex = "$(Build.Repository.Name)".IndexOf("/")
-      if ($pathSeparatorIndex -ge 0) {
-        $buildRepoName = "$(Build.Repository.Name)".Substring($pathSeparatorIndex + 1)
-      }
-      else {
-        $buildRepoName = "$(Build.Repository.Name)"
-      }
-
-      $engDockerToolsPath = "$(Build.Repository.LocalPath)/$buildRepoName/$(engDockerToolsRelativePath)"
-
-      $engPath = "$(Build.Repository.LocalPath)/$buildRepoName/eng"
-      $manifest = "$buildRepoName/$(manifest)"
-      $testResultsDirectory = "$buildRepoName/$testResultsDirectory"
-
-      if ("$(testScriptPath)") {
-        $testScriptPath = "$buildRepoName/$(testScriptPath)"
-      }
-
-      echo "##vso[task.setvariable variable=buildRepoName]$buildRepoName"
-      echo "##vso[task.setvariable variable=engDockerToolsPath]$engDockerToolsPath"
-      echo "##vso[task.setvariable variable=manifest]$manifest"
-      echo "##vso[task.setvariable variable=engPath]$engPath"
-      echo "##vso[task.setvariable variable=testScriptPath]$testScriptPath"
-      echo "##vso[task.setvariable variable=testResultsDirectory]$testResultsDirectory"
-    }
-    else {
-      $versionsBasePath = ""
-      $pipelineDisabledCache = "true"
-    }
-
-    echo "##vso[task.setvariable variable=commonMatrixAndBuildOptions]$commonMatrixAndBuildOptions"
-    echo "##vso[task.setvariable variable=versionsBasePath]$versionsBasePath"
-    echo "##vso[task.setvariable variable=pipelineDisabledCache]$pipelineDisabledCache"
-  displayName: Set Common Variables for Matrix, Build, and Publish
-
-- ${{ if ne(parameters.versionsRepoRef, '') }}:
-  # Special logic is needed to copy the tsaoptions.json file to a well known location for the 1ES PT.
-  # This template has multiple checkouts and AzDO doesn't have support for dynamically determining the
-  # default repo path therefore the 1es-official logic can't calculate the repo's tsa config file path.
-  - task: CopyFiles@2
-    displayName: Copy TSA Config
-    inputs:
-      SourceFolder: '$(Build.Repository.LocalPath)/$(buildRepoName)'
-      Contents: '.config/tsaoptions.json'
-      TargetFolder: '$(Build.SourcesDirectory)'
diff --git a/eng/docker-tools/templates/variables/docker-images.yml b/eng/docker-tools/templates/variables/docker-images.yml
index 64f802e1be..a113059634 100644
--- a/eng/docker-tools/templates/variables/docker-images.yml
+++ b/eng/docker-tools/templates/variables/docker-images.yml
@@ -1,5 +1,5 @@
 variables:
-  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder:3012807
+  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:ec9d58ce2f6926c5a3cc8ec56e8a612143c9c35bdba1f2cd5615d3d7a91c9287
   imageNames.imageBuilder: $(imageNames.imageBuilderName)
   imageNames.imageBuilder.withrepo: imagebuilder-withrepo:$(Build.BuildId)-$(System.JobId)
   imageNames.testRunner: mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux3.0-docker-testrunner

From 48998fa8dcc87c508213b98e6a7d4ae96f65abca Mon Sep 17 00:00:00 2001
From: "net-containers-bot[bot]"
 <307772199+net-containers-bot[bot]@users.noreply.github.com>
Date: Fri, 31 Jul 2026 23:14:39 +0000
Subject: [PATCH 2/8] Update common Docker engineering infrastructure from
 mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:01b9ecbc6c126e25aec9060c8fe4d4a8bf84babcfed7422b136a29bc4c607513

---
 eng/docker-tools/templates/variables/docker-images.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/docker-tools/templates/variables/docker-images.yml b/eng/docker-tools/templates/variables/docker-images.yml
index a113059634..0c9f5e14d0 100644
--- a/eng/docker-tools/templates/variables/docker-images.yml
+++ b/eng/docker-tools/templates/variables/docker-images.yml
@@ -1,5 +1,5 @@
 variables:
-  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:ec9d58ce2f6926c5a3cc8ec56e8a612143c9c35bdba1f2cd5615d3d7a91c9287
+  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:01b9ecbc6c126e25aec9060c8fe4d4a8bf84babcfed7422b136a29bc4c607513
   imageNames.imageBuilder: $(imageNames.imageBuilderName)
   imageNames.imageBuilder.withrepo: imagebuilder-withrepo:$(Build.BuildId)-$(System.JobId)
   imageNames.testRunner: mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux3.0-docker-testrunner

From 1f0b2ab0911f181930cb3856b33c5f7247ddaa2b Mon Sep 17 00:00:00 2001
From: "net-containers-bot[bot]"
 <307772199+net-containers-bot[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 22:19:57 +0000
Subject: [PATCH 3/8] Update common Docker engineering infrastructure from
 mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:625a51b1f94918c079078c96870b8ef5a79fdc070b814e749c00edcb93ea7d84

---
 eng/docker-tools/Install-DotNetSdk.ps1                 | 2 +-
 eng/docker-tools/templates/jobs/cg-build-projects.yml  | 2 +-
 eng/docker-tools/templates/variables/docker-images.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/eng/docker-tools/Install-DotNetSdk.ps1 b/eng/docker-tools/Install-DotNetSdk.ps1
index 35f6516e45..07206c09c4 100644
--- a/eng/docker-tools/Install-DotNetSdk.ps1
+++ b/eng/docker-tools/Install-DotNetSdk.ps1
@@ -20,7 +20,7 @@ param(
     [string]
     $InstallPath,
     [string]
-    $Channel = "9.0"
+    $Channel = "10.0"
 )
 
 Set-StrictMode -Version Latest
diff --git a/eng/docker-tools/templates/jobs/cg-build-projects.yml b/eng/docker-tools/templates/jobs/cg-build-projects.yml
index 10d50689f6..ade54b50da 100644
--- a/eng/docker-tools/templates/jobs/cg-build-projects.yml
+++ b/eng/docker-tools/templates/jobs/cg-build-projects.yml
@@ -15,7 +15,7 @@ parameters:
 # See https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-install-script#options for possible Channel values
 - name: dotnetVersionChannel
   type: string
-  default: '9.0'
+  default: '10.0'
   displayName: .NET Version
 # Additional steps to run before building projects (e.g. custom SDK installation).
 - name: initSteps
diff --git a/eng/docker-tools/templates/variables/docker-images.yml b/eng/docker-tools/templates/variables/docker-images.yml
index 0c9f5e14d0..d926fc551c 100644
--- a/eng/docker-tools/templates/variables/docker-images.yml
+++ b/eng/docker-tools/templates/variables/docker-images.yml
@@ -1,5 +1,5 @@
 variables:
-  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:01b9ecbc6c126e25aec9060c8fe4d4a8bf84babcfed7422b136a29bc4c607513
+  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:625a51b1f94918c079078c96870b8ef5a79fdc070b814e749c00edcb93ea7d84
   imageNames.imageBuilder: $(imageNames.imageBuilderName)
   imageNames.imageBuilder.withrepo: imagebuilder-withrepo:$(Build.BuildId)-$(System.JobId)
   imageNames.testRunner: mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux3.0-docker-testrunner

From 57306515977eb5305a100a308cdf2daaf9488f7a Mon Sep 17 00:00:00 2001
From: "net-containers-bot[bot]"
 <307772199+net-containers-bot[bot]@users.noreply.github.com>
Date: Tue, 4 Aug 2026 14:50:04 +0000
Subject: [PATCH 4/8] Update common Docker engineering infrastructure from
 mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:48ef742fad35992699f740ea5127d4d406c0e5a37579bcb4fce52011cf1bf364

---
 eng/docker-tools/templates/variables/docker-images.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/docker-tools/templates/variables/docker-images.yml b/eng/docker-tools/templates/variables/docker-images.yml
index d926fc551c..323f2eb775 100644
--- a/eng/docker-tools/templates/variables/docker-images.yml
+++ b/eng/docker-tools/templates/variables/docker-images.yml
@@ -1,5 +1,5 @@
 variables:
-  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:625a51b1f94918c079078c96870b8ef5a79fdc070b814e749c00edcb93ea7d84
+  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:48ef742fad35992699f740ea5127d4d406c0e5a37579bcb4fce52011cf1bf364
   imageNames.imageBuilder: $(imageNames.imageBuilderName)
   imageNames.imageBuilder.withrepo: imagebuilder-withrepo:$(Build.BuildId)-$(System.JobId)
   imageNames.testRunner: mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux3.0-docker-testrunner

From f8c73c074b0e1cf1f1a2b405911c1dd89f494118 Mon Sep 17 00:00:00 2001
From: "net-containers-bot[bot]"
 <307772199+net-containers-bot[bot]@users.noreply.github.com>
Date: Wed, 5 Aug 2026 17:10:39 +0000
Subject: [PATCH 5/8] Update common Docker engineering infrastructure from
 mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:8807981d0efacef3821d2192884ddc3dd4b36790354b7ca7af7203e467b06f1b

---
 eng/docker-tools/templates/variables/docker-images.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/docker-tools/templates/variables/docker-images.yml b/eng/docker-tools/templates/variables/docker-images.yml
index 323f2eb775..6804c8c50e 100644
--- a/eng/docker-tools/templates/variables/docker-images.yml
+++ b/eng/docker-tools/templates/variables/docker-images.yml
@@ -1,5 +1,5 @@
 variables:
-  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:48ef742fad35992699f740ea5127d4d406c0e5a37579bcb4fce52011cf1bf364
+  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:8807981d0efacef3821d2192884ddc3dd4b36790354b7ca7af7203e467b06f1b
   imageNames.imageBuilder: $(imageNames.imageBuilderName)
   imageNames.imageBuilder.withrepo: imagebuilder-withrepo:$(Build.BuildId)-$(System.JobId)
   imageNames.testRunner: mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux3.0-docker-testrunner

From 8ccd175c6890b836785185bea2776f67b821e7a7 Mon Sep 17 00:00:00 2001
From: "net-containers-bot[bot]"
 <307772199+net-containers-bot[bot]@users.noreply.github.com>
Date: Mon, 10 Aug 2026 17:15:40 +0000
Subject: [PATCH 6/8] Update common Docker engineering infrastructure from
 mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:d78d0dc57084418cf0009d58e8eef191bc4045f8dc233e24f708058fb7ff5501

---
 eng/docker-tools/templates/variables/docker-images.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/docker-tools/templates/variables/docker-images.yml b/eng/docker-tools/templates/variables/docker-images.yml
index 6804c8c50e..f80700615d 100644
--- a/eng/docker-tools/templates/variables/docker-images.yml
+++ b/eng/docker-tools/templates/variables/docker-images.yml
@@ -1,5 +1,5 @@
 variables:
-  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:8807981d0efacef3821d2192884ddc3dd4b36790354b7ca7af7203e467b06f1b
+  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:d78d0dc57084418cf0009d58e8eef191bc4045f8dc233e24f708058fb7ff5501
   imageNames.imageBuilder: $(imageNames.imageBuilderName)
   imageNames.imageBuilder.withrepo: imagebuilder-withrepo:$(Build.BuildId)-$(System.JobId)
   imageNames.testRunner: mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux3.0-docker-testrunner

From 6ee891ef48523e4a744f5e7729482e63c50e2700 Mon Sep 17 00:00:00 2001
From: "net-containers-bot[bot]"
 <307772199+net-containers-bot[bot]@users.noreply.github.com>
Date: Tue, 11 Aug 2026 21:26:33 +0000
Subject: [PATCH 7/8] Update common Docker engineering infrastructure from
 mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:50bbef5b6a77ef620da3f3f759a83d870ca73a53fd19e7d8c422e3717e7f97ec

---
 eng/docker-tools/templates/variables/docker-images.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/docker-tools/templates/variables/docker-images.yml b/eng/docker-tools/templates/variables/docker-images.yml
index f80700615d..74273280ff 100644
--- a/eng/docker-tools/templates/variables/docker-images.yml
+++ b/eng/docker-tools/templates/variables/docker-images.yml
@@ -1,5 +1,5 @@
 variables:
-  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:d78d0dc57084418cf0009d58e8eef191bc4045f8dc233e24f708058fb7ff5501
+  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:50bbef5b6a77ef620da3f3f759a83d870ca73a53fd19e7d8c422e3717e7f97ec
   imageNames.imageBuilder: $(imageNames.imageBuilderName)
   imageNames.imageBuilder.withrepo: imagebuilder-withrepo:$(Build.BuildId)-$(System.JobId)
   imageNames.testRunner: mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux3.0-docker-testrunner

From 7b67ff76d397c281c3c9169169467b2f4f7cc1a8 Mon Sep 17 00:00:00 2001
From: "net-containers-bot[bot]"
 <307772199+net-containers-bot[bot]@users.noreply.github.com>
Date: Thu, 13 Aug 2026 05:06:18 +0000
Subject: [PATCH 8/8] Update common Docker engineering infrastructure from
 mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:ebaeb7008d62ececb11335024efcddfc8cdd118b572d6784856386760af14d6d

---
 eng/docker-tools/templates/variables/docker-images.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/docker-tools/templates/variables/docker-images.yml b/eng/docker-tools/templates/variables/docker-images.yml
index 74273280ff..c3cb5c317e 100644
--- a/eng/docker-tools/templates/variables/docker-images.yml
+++ b/eng/docker-tools/templates/variables/docker-images.yml
@@ -1,5 +1,5 @@
 variables:
-  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:50bbef5b6a77ef620da3f3f759a83d870ca73a53fd19e7d8c422e3717e7f97ec
+  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder@sha256:ebaeb7008d62ececb11335024efcddfc8cdd118b572d6784856386760af14d6d
   imageNames.imageBuilder: $(imageNames.imageBuilderName)
   imageNames.imageBuilder.withrepo: imagebuilder-withrepo:$(Build.BuildId)-$(System.JobId)
   imageNames.testRunner: mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux3.0-docker-testrunner