[
  {
    "id": "dotnet-worker-runtime-image",
    "category": "dockerfile",
    "pattern": "BackgroundService|IHostedService|Worker",
    "recommendation": "Use mcr.microsoft.com/dotnet/runtime for worker services instead of aspnet - workers don't need ASP.NET runtime overhead",
    "example": "# Build stage\nFROM mcr.microsoft.com/dotnet/sdk:8.0-alpine AS build\n\n# Runtime stage\nFROM mcr.microsoft.com/dotnet/runtime:8.0-alpine\nWORKDIR /app\nCOPY --from=build /app/publish .",
    "severity": "high",
    "tags": [
      "background-jobs",
      "dotnet",
      "fix-dockerfile",
      "generate-dockerfile",
      "microsoft",
      "optimization",
      "runtime",
      "worker"
    ]
  },
  {
    "id": "dotnet-worker-nonroot-user",
    "category": "security",
    "pattern": "BackgroundService|Worker|Hangfire|Quartz",
    "recommendation": "Run background workers as non-root user for security - workers process untrusted data and should have minimal privileges",
    "example": "RUN addgroup -g 1001 -S workergroup && adduser -u 1001 -S workeruser -G workergroup\nCOPY --from=build /app/publish .\nRUN chown -R workeruser:workergroup /app\nUSER workeruser",
    "severity": "high",
    "tags": [
      "background-jobs",
      "dotnet",
      "fix-dockerfile",
      "non-root",
      "scan-image",
      "security",
      "worker"
    ]
  },
  {
    "id": "dotnet-worker-health-endpoint",
    "category": "reliability",
    "pattern": "BackgroundService|IHostedService|Worker",
    "recommendation": "Expose health check endpoint for worker services to enable Kubernetes liveness and readiness probes",
    "example": "# In Dockerfile\nENV HealthCheck__Enabled=\"true\"\nENV HealthCheck__Port=\"8080\"\nENV HealthCheck__Endpoint=\"/health\"\nEXPOSE 8080\n\n# In Program.cs\nbuilder.Services.AddHealthChecks();",
    "severity": "high",
    "tags": [
      "dotnet",
      "worker",
      "health-check",
      "kubernetes",
      "reliability",
      "background-jobs"
    ]
  },
  {
    "id": "dotnet-worker-graceful-shutdown",
    "category": "reliability",
    "pattern": "BackgroundService|IHostedService|Worker",
    "recommendation": "Configure graceful shutdown timeouts for workers to complete in-flight jobs before termination",
    "example": "ENV Shutdown__TimeoutSeconds=\"30\"\nENV Shutdown__ForceKillAfterSeconds=\"60\"\n\n# In Program.cs\nbuilder.Host.ConfigureHostOptions(opts => opts.ShutdownTimeout = TimeSpan.FromSeconds(30));",
    "severity": "medium",
    "tags": [
      "dotnet",
      "worker",
      "shutdown",
      "reliability",
      "background-jobs"
    ]
  },
  {
    "id": "dotnet-hangfire-redis-distributed",
    "category": "architecture",
    "pattern": "Hangfire",
    "recommendation": "Use Redis storage for distributed Hangfire processing across multiple servers instead of SQL Server for better performance",
    "example": "# Hangfire.Redis configuration\nENV Hangfire__Storage=\"Redis\"\nENV ConnectionStrings__Redis=\"redis:6379\"\nENV Hangfire__Redis__Database=\"0\"\nENV Hangfire__Redis__Prefix=\"hangfire:\"\nENV Hangfire__WorkerCount=\"10\"",
    "severity": "medium",
    "tags": [
      "dotnet",
      "hangfire",
      "redis",
      "distributed",
      "scalability",
      "background-jobs"
    ]
  },
  {
    "id": "dotnet-worker-gc-optimization",
    "category": "optimization",
    "pattern": "BackgroundService|Worker|batch|processing",
    "recommendation": "Enable server GC and configure memory settings for background workers processing large workloads",
    "example": "# Server GC for better throughput\nENV DOTNET_gcServer=1\nENV DOTNET_GCHighMemPercent=75\nENV DOTNET_GCRetainVM=1\n\n# For batch processing\nENV DOTNET_gcConcurrent=1",
    "severity": "medium",
    "tags": [
      "background-jobs",
      "dotnet",
      "gc",
      "generate-dockerfile",
      "optimization",
      "performance",
      "worker"
    ]
  },
  {
    "id": "dotnet-worker-threadpool-tuning",
    "category": "optimization",
    "pattern": "parallel|concurrent|throughput",
    "recommendation": "Tune thread pool settings for high-throughput background processing workloads",
    "example": "# Thread pool optimization for high concurrency\nENV DOTNET_ThreadPool_UnfairSemaphoreSpinLimit=70\nENV DOTNET_System_Threading_ThreadPool_UnfairSemaphoreSpinLimit=70\n\n# Application configuration\nENV Processing__MaxConcurrency=\"10\"\nENV Processing__MaxParallelism=\"8\"",
    "severity": "low",
    "tags": [
      "background-jobs",
      "concurrency",
      "dotnet",
      "generate-dockerfile",
      "optimization",
      "performance",
      "threading"
    ]
  },
  {
    "id": "dotnet-quartz-persistence",
    "category": "configuration",
    "pattern": "Quartz",
    "recommendation": "Configure Quartz.NET with persistent job store and clustering for reliable scheduled job execution across restarts",
    "example": "ENV Quartz__Scheduler__InstanceName=\"QuartzScheduler\"\nENV Quartz__Scheduler__InstanceId=\"AUTO\"\nENV Quartz__JobStore__Type=\"Quartz.Impl.AdoJobStore.JobStoreTX, Quartz\"\nENV Quartz__JobStore__IsClustered=\"true\"\nENV Quartz__JobStore__ClusterCheckinInterval=\"20000\"",
    "severity": "high",
    "tags": [
      "dotnet",
      "quartz",
      "scheduling",
      "persistence",
      "clustering",
      "background-jobs"
    ]
  },
  {
    "id": "dotnet-messagequeue-rabbitmq",
    "category": "configuration",
    "pattern": "RabbitMQ|message.*queue",
    "recommendation": "Configure RabbitMQ message queue processing with dead letter queues and retry policies for fault tolerance",
    "example": "ENV MessageQueue__Provider=\"RabbitMQ\"\nENV MessageQueue__RabbitMQ__Host=\"rabbitmq\"\nENV Processing__QueueName=\"background-jobs\"\nENV Processing__PrefetchCount=\"10\"\nENV Processing__MaxRetryAttempts=\"3\"\nENV Processing__DeadLetterQueue=\"background-jobs-dlq\"",
    "severity": "medium",
    "tags": [
      "dotnet",
      "rabbitmq",
      "message-queue",
      "reliability",
      "background-jobs"
    ]
  },
  {
    "id": "dotnet-messagequeue-servicebus",
    "category": "configuration",
    "pattern": "ServiceBus|Azure.*Service.*Bus",
    "recommendation": "Configure Azure Service Bus for cloud-native message processing with proper concurrency and auto-renewal settings",
    "example": "ENV MessageQueue__Provider=\"ServiceBus\"\nENV MessageQueue__ServiceBus__QueueName=\"background-jobs\"\nENV Processing__MaxConcurrentCalls=\"10\"\nENV Processing__MaxAutoRenewDuration=\"00:05:00\"\nENV Processing__RetryDelay=\"00:01:00\"",
    "severity": "medium",
    "tags": [
      "dotnet",
      "azure",
      "service-bus",
      "message-queue",
      "cloud",
      "background-jobs"
    ]
  },
  {
    "id": "dotnet-batch-memory-management",
    "category": "optimization",
    "pattern": "batch|bulk|large.*data",
    "recommendation": "Configure memory limits and GC pressure thresholds for large-scale batch processing to prevent out-of-memory errors",
    "example": "# Memory management for batch processing\nENV Batch__ChunkSize=\"1000\"\nENV Batch__MaxParallelism=\"8\"\nENV Processing__MaxMemoryUsage=\"2GB\"\nENV Processing__MemoryPressureThreshold=\"1.5GB\"\nENV Processing__GCPressureThreshold=\"85\"",
    "severity": "high",
    "tags": [
      "background-jobs",
      "batch",
      "dotnet",
      "generate-dockerfile",
      "google",
      "memory",
      "optimization",
      "performance"
    ]
  },
  {
    "id": "dotnet-cron-scheduling",
    "category": "configuration",
    "pattern": "cron|schedule|NCrontab",
    "recommendation": "Use NCrontab for cron-based job scheduling with proper timezone configuration and missed job handling",
    "example": "ENV CronScheduler__TimeZone=\"UTC\"\nENV CronScheduler__MaxConcurrentJobs=\"5\"\nENV CronScheduler__MissedJobThreshold=\"00:05:00\"\n\n# Job definitions with cron expressions\nENV Jobs__DataSync__Schedule=\"0 */5 * * * *\"\nENV Jobs__Cleanup__Schedule=\"0 0 2 * * *\"",
    "severity": "medium",
    "tags": [
      "dotnet",
      "cron",
      "scheduling",
      "ncrontab",
      "background-jobs"
    ]
  },
  {
    "id": "dotnet-event-driven-mediatr",
    "category": "architecture",
    "pattern": "MediatR|event.*handler|domain.*event",
    "recommendation": "Configure event-driven processing with MediatR using retry policies and dead letter queues for failed events",
    "example": "ENV EventProcessing__MaxConcurrentEvents=\"20\"\nENV EventProcessing__EventTimeout=\"00:10:00\"\nENV EventProcessing__RetryPolicy=\"Exponential\"\nENV EventProcessing__MaxRetryAttempts=\"5\"\nENV DeadLetter__Enabled=\"true\"\nENV DeadLetter__MaxRetentionDays=\"30\"",
    "severity": "medium",
    "tags": [
      "dotnet",
      "mediatr",
      "events",
      "cqrs",
      "architecture",
      "background-jobs"
    ]
  },
  {
    "id": "dotnet-worker-monitoring",
    "category": "reliability",
    "pattern": "Hangfire.*dashboard|monitoring|metrics",
    "recommendation": "Enable job monitoring dashboard and metrics collection for observability of background job execution",
    "example": "ENV Dashboard__Enabled=\"true\"\nENV Dashboard__Path=\"/jobs\"\nENV Monitoring__RefreshInterval=\"00:00:30\"\nENV Monitoring__JobHistoryLimit=\"1000\"\nENV Monitoring__EnableJobMetrics=\"true\"\nENV Monitoring__LogJobExecution=\"true\"",
    "severity": "medium",
    "tags": [
      "dotnet",
      "monitoring",
      "observability",
      "dashboard",
      "background-jobs"
    ]
  },
  {
    "id": "dotnet-worker-security-isolation",
    "category": "security",
    "pattern": "sandbox|isolation|restricted",
    "recommendation": "Implement security isolation for background workers with restricted file access and resource limits",
    "example": "# Create restricted temp directory\nRUN mkdir -p /app/temp && chown workeruser:workergroup /app/temp && chmod 750 /app/temp\n\nENV Security__EnableSandboxing=\"true\"\nENV Security__RestrictFileAccess=\"true\"\nENV Security__AllowedDirectories=\"/app/temp,/app/data\"\nENV Limits__MaxMemoryMB=\"512\"\nENV Limits__MaxExecutionTime=\"00:30:00\"",
    "severity": "medium",
    "tags": [
      "background-jobs",
      "dotnet",
      "fix-dockerfile",
      "isolation",
      "sandboxing",
      "scan-image",
      "security",
      "worker"
    ]
  },
  {
    "id": "dotnet-worker-connection-pooling",
    "category": "optimization",
    "pattern": "database|sql|entity.*framework",
    "recommendation": "Configure database connection pooling for background workers to optimize database performance and resource usage",
    "example": "ENV Database__ConnectionPoolSize=\"100\"\nENV Database__CommandTimeout=\"300\"\nENV Database__EnableConnectionMultiplexing=\"true\"\nENV Jobs__UseConnectionPooling=\"true\"",
    "severity": "medium",
    "tags": [
      "background-jobs",
      "connection-pooling",
      "database",
      "dotnet",
      "generate-dockerfile",
      "optimization"
    ]
  },
  {
    "id": "dotnet-worker-readytorun",
    "category": "optimization",
    "pattern": "performance|startup|optimization",
    "recommendation": "Enable ReadyToRun compilation for faster worker startup times, critical for autoscaling scenarios",
    "example": "# In build stage\nRUN dotnet publish -c Release -o /app/publish \\\n    --runtime linux-x64 \\\n    --self-contained false \\\n    -p:PublishReadyToRun=true\n\n# In runtime stage\nENV DOTNET_TieredPGO=1\nENV DOTNET_ReadyToRun=1",
    "severity": "low",
    "tags": [
      "background-jobs",
      "dotnet",
      "generate-dockerfile",
      "optimization",
      "performance",
      "readytorun",
      "startup"
    ]
  },
  {
    "id": "dotnet-worker-audit-logging",
    "category": "security",
    "pattern": "audit|security.*event|compliance",
    "recommendation": "Implement comprehensive audit logging for background job execution to track security events and compliance",
    "example": "ENV Audit__LogAllJobExecutions=\"true\"\nENV Audit__LogSecurityEvents=\"true\"\nENV Audit__LogResourceUsage=\"true\"\nENV Logging__AuditLog__Provider=\"Elasticsearch\"\nENV Logging__AuditLog__Elasticsearch__Index=\"worker-audit\"",
    "severity": "medium",
    "tags": [
      "audit",
      "background-jobs",
      "compliance",
      "dotnet",
      "fix-dockerfile",
      "logging",
      "scan-image",
      "security"
    ]
  },
  {
    "id": "dotnet-worker-checkpointing",
    "category": "reliability",
    "pattern": "batch|checkpoint|resume",
    "recommendation": "Enable checkpointing for long-running batch jobs to support resumption after failures or restarts",
    "example": "ENV Batch__EnableCheckpointing=\"true\"\nENV Batch__CheckpointInterval=\"00:05:00\"\nENV Batch__CheckpointLocation=\"/app/data/checkpoints\"\nENV Processing__ResumeOnStartup=\"true\"",
    "severity": "medium",
    "tags": [
      "dotnet",
      "batch",
      "checkpointing",
      "reliability",
      "resume",
      "background-jobs"
    ]
  },
  {
    "id": "dotnet-hangfire-queue-priorities",
    "category": "configuration",
    "pattern": "Hangfire|priority|queue",
    "recommendation": "Configure multiple Hangfire queues with priorities for critical, normal, and low-priority background jobs",
    "example": "ENV Hangfire__ServerName=\"${HOSTNAME}\"\nENV Hangfire__WorkerCount=\"10\"\nENV Hangfire__Queues=\"default,critical,normal,low\"\nENV Hangfire__QueuePollInterval=\"00:00:05\"\nENV Hangfire__SchedulePollingInterval=\"00:00:15\"",
    "severity": "medium",
    "tags": [
      "dotnet",
      "hangfire",
      "queues",
      "priority",
      "configuration",
      "background-jobs"
    ]
  }
]