Multi-stage Go Build
Ship a sub-15MB image with a multi-stage Dockerfile.
0 of 6 steps
What you will end up with
A tiny production image
A non-root runtime
A reproducible build
Build steps
0/6Start the Dockerfile with FROM golang AS builder and copy your source code in. This stage is the messy workshop where sawdust everywhere is completely fine.
Build with CGO disabled so the binary does not depend on any system libraries at runtime. Static means the binary packs its own lunch instead of borrowing ingredients from whatever kitchen it lands in.
Add a second, separate FROM stage using a distroless base image, which ships with nothing but the bare essentials. Distroless is an empty apartment with just plumbing, no furniture you did not bring yourself.
Use COPY --from=builder to pull just the compiled file into the final stage, leaving the source code and compiler behind. Only the finished cake leaves the workshop, never the flour and mixing bowls.
Add a non-root user, or use the one a distroless image already ships with, instead of running as root. Running as root inside a container is like leaving your house keys in the front door lock.
Check the image size and compare it to a normal Go build; a distroless multi-stage image usually lands well under 15MB. Weighing the box after packing confirms you did not sneak the whole warehouse inside.
Before you start