loading...

Slim Docker images for your Go application

andrioid profile image Andri Originally published at andri.dk on ・1 min read

How to build a slim Docker container for your Go application using multi-stage images.

I'm using Go 1.13 and the community module proxy to build the binary and Alpine as a base image. It adds a user and group instead of running as root.

Dockerfile

Be sure to replace "cmd/server/server.go" with your main file.

FROM golang:1.13 as builder

WORKDIR /app
COPY . /app
RUN CGO_ENABLED=0 GOOS=linux GOPROXY=https://proxy.golang.org go build -o app cmd/server/server.go

FROM alpine:latest
# mailcap adds mime detection and ca-certificates help with TLS (basic stuff)
RUN apk --no-cache add ca-certificates mailcap && addgroup -S app && adduser -S app -G app
USER app
WORKDIR /app
COPY --from=builder /app/app .
ENTRYPOINT ["./app"]

I hope this is helpful. I mostly blogged this to document it for myself.

Posted on by:

andrioid profile

Andri

@andrioid

Computer Engineer from Iceland, living in Denmark. I mostly post about React (Native), Go, DevOps and Linux

Discussion

markdown guide
 

Probably not for all the use cases, but you can also use the scratch container

FROM golang as base

WORKDIR /app

ENV GO111MODULE=on \
    CGO_ENABLED=0 \
    GOOS=linux \
    GOARCH=amd64

COPY go.mod .
COPY go.sum .

RUN go mod download

COPY . .

# it will take the flags from the environment
RUN go build

### Certs
FROM alpine:latest as certs
RUN apk --update add ca-certificates

### App
FROM scratch as app
COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=base app /
ENTRYPOINT ["/app"]

So its even smaller than alpine 😄

And it uses and caches modules so the download command will only be executed if something changed either on go.mod or go.sum

Hope it helps!

 

trying to remember what problems I faced with scratch image before I switched to alpine :/ Have you encountered any?

 

Scratch is still my go-to. Only the ssl thing handled here. That reeeeally angered me the first time when I pulled the perfectly crafted images into prod and every. call. failed.

Learned that lesson the hard way 🤷‍♀️

Update: I re-read this dockerfile and I like this one much more than mine. Alright if I borrow that? 😅

I think the problem I had was when I needed to do some external linking with C libs :) Then the first example wouldn't have worked either, you then need to use alpine as an initial build image too.

Scratch is great, but it DEFINITELY depends on your workload. I haven't personally built anything that couldn't run in it, but I'm positive there are limits.

  • my rabbit work queues blaze in scratch.
  • pretty sure basic image manipulation would fail.

Such is scratch lol

Well I think your arguments are very valid, as I said it is not for all the use cases, still we are using it in prod for heavy load micro services and stream producers/consumers and so far its going surprisingly smooth, now I feel very lucky 😂

Oh, don't get me wrong lol! My scratch-go images... Whoo! I have a single, polymorphic binary that blows my friggin socks off. It's a warehousing pipeline that can produce OR consume billions of records per day from who knows what sources. A damn tank, running on scratch.

Lol but I'd be nervous as crap deploying something that needs imagemagick via a scratch build 🤣

 

Nothing so far, at least not that I can remember right now. 🤔

 

Add -ldflags '-s -w' to go build to strip DWARF, symbol table and debug info. Expect ~25% binary size decrease.

golang.org/cmd/link/

 

I really like multi-stages Dockerfiles for Go apps.