How do you build a minimal Docker image for a Go service?

Question

Accepted Answer

# Stage 1: Build
FROM golang:1.22-alpine AS builder

# Install dependencies for CGo if needed
# RUN apk add --no-cache gcc musl-dev

WORKDIR /app

# Cache go modules separately from source
COPY go.mod go.sum ./
RUN go mod download

COPY . .

# Build static binary
RUN CGO_ENABLED=0 GOOS=linux go build \
    -ldflags='-w -s -extldflags "-static"' \
    -o /server ./cmd/server

# Stage 2: Minimal runtime
FROM gcr.io/distroless/static:nonroot
# Alternative: FROM scratch (no shell, no CA certs, no users)
# Use distroless for CA certs and non-root user out of the box

# Copy binary from builder
COPY --from=builder /server /server

# Copy any required static files
# COPY --from=builder /app/migrations /migrations

USER nonroot:nonroot
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s \
    CMD ["/server", "-health-check"]
ENTRYPOINT ["/server"] distroless/static: ~3MB base, includes CA certs and timezone data — recommended for most services scratch: 0 bytes base — only works if your binary is 100% static and you don't need CA certs -ldflags '-w -s' strips debug info — reduces binary size by 20-30% Cache go mod download layer separately — rebuilds only when go.mod/go.sum change Run as non-root user in production — distroless nonroot image provides uid 65532

How do you build a minimal Docker image for a Go service?

Use a multi-stage Docker build: compile in a golang image, then copy only the binary to a distroless or scratch image. Result is a 5-15MB image vs 800MB+ with the full Go image.

How do you build a minimal Docker image for a Go service?

Use a multi-stage Docker build: compile in a golang image, then copy only the binary to a distroless or scratch image. Result is a 5-15MB image vs 800MB+ with the full Go image.

Scenario Questions

Follow-up Questions