.NET Docker: Should I also update runtime base image when newer version of SDK is required for build multitarget dependency?

I have dependency projects with multitargets:

<TargetFrameworks>net8.0;net7.0;net6.0;net48</TargetFrameworks>

And my other microservices are build on .NET 7:

<TargetFramework>net7.0</TargetFramework>

In Dockerfile, I needed to upgrade Build base image to .NET 8 SDK to fix build errors:

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build

But my question is:

If my microservice project (Docker's ENTRYPOINT) is build on .NET 7, can (and should) I update the runtime image to .NET 8? There are some security reasons maybe?

FROM mcr.microsoft.com/dotnet/aspnet:7.0 AS base ---> :8.0

Solution

The .NET version of the aspnet image should match the version that the project is targeting. Since your microservice is targeting .NET 7, your aspnet image should remain with the 7.0 tag. It's perfectly acceptable to use the .NET 8 SDK, though, since it's capable of building (but not running) projects that target older versions. That said, if you're able to upgrade the project to .NET 8, that would be better to get all the benefits of bug fixes, improved performance, and features.