.NET Core 3.0 Docker Container Won't Connect to SQL Server

Question

We have upgraded some of our .NET Core 2.2 applications to .NET Core 3.0. After the upgrade, our applications running in Docker containers fail to connect to SQL Server 2016 running on a standalone machine in our domain network. Reviewing the packet trace, we see that the connection hangs at the Pre-Login handshake, and eventually times out. Switching back to .NET Core 2.2 resolves the issue immediately, and our containers can again connect to our databases.

We have obviously verified that there are no DNS issues, since these containers are running in production with .NET Core 2.2. .NET Core 3.0 breaks them as they cannot connect to SQL Server over the network, so we are rolling back to 2.2 for now and terminating the upgrade until we can determine why .NET Core 2.2 containers connect to our SQL Servers but .NET Core 3.0 containers do not.

We have also created new .NET Core 3.0 projects from scratch to test the connection. The result is the same: the containers time out during Pre-Login to SQL Server. Changing the project back to .NET Core 2.2, along with EF Core back to 2.2.6, and the issue is immediately resolved.

As we are using EF Core for data access, we have also tried leaving EF Core at 2.2.6 but upgrading the project to .NET Core 3.0, but the connection still times out.

If we do not add Docker support and run the apps as Console or Web apps (not containerized), then there are no issues with .NET Core 3.0. It is only when we containerize them that .NET Core 3.0 apps fail to connect to SQL Server.

Per Dan's suggestion in the comments below, I changed the data access in the test project to Microsoft.Data.SqlClient using hand-written SQL and a DataReader. I then recreated the Dockerfile for .net core 3.0 and verified that the correct container image was referenced. Same behavior: hung at PreLogin handshake with SQL Server. Switched to .net core 2.2 and was able to connect and read data from SQL Server.

Answer 1

This appears to be due to the TLS version used by the Linux image. With help from .NET Core team at GitHub we changed the image from buster-slim to bionic in the Dockerfile.

FROM mcr.microsoft.com/dotnet/core/aspnet:3.0-bionic AS base
WORKDIR /app
EXPOSE 80

FROM mcr.microsoft.com/dotnet/core/sdk:3.0-bionic AS build

https://github.com/dotnet/SqlClient/issues/222