Update CONTRIBUTING.md (#5046)

CONTRIBUTING.md

@@ -2,26 +2,59 @@
 
 See [dotnet/runtime Contributing](https://github.com/dotnet/runtime/blob/master/CONTRIBUTING.md) for information about coding styles, source structure, making pull requests, and more.
 
-## Branches
+## General Feedback and Questions
+
+Please open a [discussion](https://github.com/dotnet/dotnet-docker/discussions).
+
+## Reporting Security Issues
+
+Please keep in mind that the GitHub issue tracker is intended for reporting **non-security** bugs and feature requests.
+
+If you're reporting the presence of an already disclosed security vulnerability, such as a CVE reported in one of our container images, please follow the documented [guidance on vulnerability reporting](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md).
+
+If you believe you have an issue that affects the security of .NET, please do NOT create an issue and instead email your issue details to secure@microsoft.com.
+Your report may be eligible for our [bug bounty](https://www.microsoft.com/en-us/msrc/bounty-dot-net-core), but ONLY if it is reported through email.
+
+## Bugs and Feature Requests
+
+Before reporting a new issue, try to find an existing issue if one already exists.
+If it already exists, please upvote it (👍) or add a comment to the issue with your unique scenario and requirements.
+Upvotes and clear details on the issue's impact help us prioritize issues to work on.
+If you can't find an existing issue, file a new one - we would rather get duplicate feedback than none.
+
+We aspire to respond to all GitHub issues within 48 hours (first contact).
+We triage issues and decide which issues to prioritize on a weekly basis, so if you don't receive a reply within a week or two, please feel free to add another reply to your own issue or mention the @dotnet/dotnet-docker-reviewers team.
+
+## How to Submit a PR
+
+### Before you write code...
+
+Please consider opening a feature request.
+We are happy to accept community contributions - however, until we discuss your specifc ideas and features as a team, we can't guarantee that we will accept all community PRs.
+The last thing we want is for you to spend time on an implementation before the team and community agree on the proposed change.
+Once the community and the .NET team are in agreement on a proposal, we are happy to work on the feature ourselves.
+However, if you'd still like to implement it yourself, you can request the issue be assigned to you.
+
+### Branches
 
 When making PRs, all source code changes (e.g. Dockerfiles, tests, and infrastructure) should be made in the [nightly branch](https://github.com/dotnet/dotnet-docker/tree/nightly). Only changes to the samples and documentation will be accepted against the [main branch](https://github.com/dotnet/dotnet-docker/tree/main).
 
-## Workflow Instructions
+### Workflow Instructions
 
-### Building
+#### Building
 
 The [`build-and-test.ps1`](https://github.com/dotnet/dotnet-docker/blob/main/build-and-test.ps1) script will build and test the .NET Docker images. Given the matrix of supported .NET versions, distros, and architectures there are numerous Dockerfiles and building can take a while. To make this manageable, the script supports several options for filtering down what images get built and tested.
 
-- Build and test all of the .NET 6.0 images for the Docker platform your machine is targeting (e.g. linux/x64, linux/arm, linux/arm64, windows/x64).
+- Build and test all of the .NET 8.0 images for the Docker platform your machine is targeting (e.g. linux/x64, linux/arm, linux/arm64, windows/x64).
 
     ``` console
-    > ./build-and-test.ps1 -Version 6.0
+    > ./build-and-test.ps1 -Version 8.0
     ```
 
-- Build the 6.0 Nano Server 1809 images
+- Build the 8.0 Nano Server 1809 images
 
     ``` console
-    > ./build-and-test.ps1 -Version 6.0 -OS nanoserver-1809 -Mode Build
+    > ./build-and-test.ps1 -Version 8.0 -OS nanoserver-1809 -Mode Build
     ```
 
 - Build and test the samples
@@ -30,21 +63,21 @@ The [`build-and-test.ps1`](https://github.com/dotnet/dotnet-docker/blob/main/bui
     > ./build-and-test.ps1 -Path *samples* -TestCategories sample
     ```
 
-- Test the 6.0 Ubuntu Jammy images for the current architecture (e.g. x64, arm, arm64).
+- Test the 8.0 Ubuntu Jammy images for the current architecture (e.g. x64, arm, arm64).
 
     ``` console
-    > ./build-and-test.ps1 -Version 6.0 -OS jammy -Mode Test
+    > ./build-and-test.ps1 -Version 8.0 -OS jammy -Mode Test
     ```
 
-### Editing Dockerfiles
+#### Editing Dockerfiles
 
 The [Dockerfiles](https://github.com/search?q=repo%3Adotnet%2Fdotnet-docker+filename%3ADockerfile&type=Code&ref=advsearch&l=&l=) contained in this repo are generated from a set of [Cottle](https://cottle.readthedocs.io/en/stable/page/01-overview.html) based [templates](https://github.com/dotnet/dotnet-docker/tree/main/eng/dockerfile-templates). A single template generates the set of Dockerfiles that are similar (e.g. all Windows sdk Dockerfiles for a particular .NET version).  This ensures consistency across the various Dockerfiles and eases the burden of making changes to the Dockerfiles.  Instead of editing the Dockerfiles directly, the templates should be updated and then the Dockerfiles should get regenerated by running the [generate Dockerfiles script](https://github.com/dotnet/dotnet-docker/blob/main/eng/dockerfile-templates/Get-GeneratedDockerfiles.ps1).
 
-### Editing READMEs
+#### Editing READMEs
 
 The [READMEs](https://github.com/search?q=repo%3Adotnet%2Fdotnet-docker+filename%3AREADME+path%3A%2F&type=Code&ref=advsearch&l=&l=) contained in this repo are used as the descriptions for the Docker repositories the images are published to.  Just like the Dockerfiles, the READMEs are generated from a set of [Cottle](https://cottle.readthedocs.io/en/stable/page/01-overview.html) based [templates](https://github.com/dotnet/dotnet-docker/tree/main/eng/readme-templates).  This ensures consistency across the various READMEs and eases the burden of making changes.  Instead of editing the READMEs directly, the templates should be updated and then the READMEs should get regenerated by running the [generate READMEs script](https://github.com/dotnet/dotnet-docker/blob/main/eng/readme-templates/Get-GeneratedReadmes.ps1).
 
-### Tests
+#### Tests
 
 There are two basic types of [tests](https://github.com/dotnet/dotnet-docker/tree/main/tests) for each of the images produced from this repo.
 
@@ -53,7 +86,7 @@ There are two basic types of [tests](https://github.com/dotnet/dotnet-docker/tre
 
 When editing Dockerfiles, please ensure the appropriate test changes are also made.
 
-### Metadata Changes
+#### Metadata Changes
 
 The [`manifest.json`](https://github.com/dotnet/dotnet-docker/blob/main/manifest.json) contains metadata used by the engineering infrastructure to build and publish the images.  It includes information such as:
 
@@ -66,7 +99,7 @@ The [`manifest.json`](https://github.com/dotnet/dotnet-docker/blob/main/manifest
 
 When adding or removing Dockerfiles, it is important to update the `manifest.json` accordingly.
 
-### Updating Product Versions
+#### Updating Product Versions
 
 Updating the product versions (e.g. .NET runtime, ASP.NET runtime, PowerShell, etc.) contained within the images is typically performed by automation. All of the product version information is stored in the [`manifest.versions.json`](https://github.com/dotnet/dotnet-docker/blob/main/manifest.versions.json) file. The Dockerfile templates reference the product versions numbers and checksums from this file. Updating a product version involves updating the `manifest.versions.json` and regenerating the Dockerfiles. If there are cases where you need to update a product version, you can use the [update-dependencies](https://github.com/dotnet/dotnet-docker/tree/main/eng/update-dependencies) tool.  The tool will do the following:
 
@@ -76,10 +109,10 @@ Updating the product versions (e.g. .NET runtime, ASP.NET runtime, PowerShell, e
 
 The following examples illustrate how to run `update-dependencies`:
 
-- Update the 6.0 product versions (uses a helper script for running update-dependencies)
+- Update the 8.0 product versions (uses a helper script for running update-dependencies)
 
     ``` console
-    > ./eng/Set-DotnetVersions.ps1 -ProductVersion 6.0 -SdkVersion 6.0.404 -RuntimeVersion 6.0.12 -AspnetVersion 6.0.12
+    > ./eng/Set-DotnetVersions.ps1 -ProductVersion 8.0 -SdkVersion 8.0.100 -RuntimeVersion 8.0.0 -AspnetVersion 8.0.0
     ```
 
 - Update the .NET Monitor version (uses a helper script for running update-dependencies)
@@ -88,8 +121,8 @@ The following examples illustrate how to run `update-dependencies`:
     > ./eng/Set-DotnetVersions.ps1 -ProductVersion 6.3 -MonitorVersion 6.3.1
     ```
 
-- Update the PowerShell version used in the 6.0 images
+- Update the PowerShell version used in the 8.0 images
 
     ``` console
-    > dotnet run --project .\eng\update-dependencies\ -- 6.0 --product-version powershell=7.2.7 --compute-shas
+    > dotnet run --project .\eng\update-dependencies\ -- 8.0 --product-version powershell=7.2.7 --compute-shas
     ```