Go

1# =============================================================================
2# Go Production Dockerfile
3# =============================================================================
4# Customize the following before use:
5#   - APP_NAME:    Replace "app" in the binary name (go build -o /bin/app)
6#                  and in the ENTRYPOINT ["/app"] line
7#   - PORT:        Change EXPOSE port if not 8080
8#   - MODULE_PATH: Ensure go.mod module path matches your project
9#
10# Notes:
11#   - CGO_ENABLED=0 produces a fully static binary that runs on distroless
12#   - The distroless runtime has no shell — use the exec form for ENTRYPOINT
13#   - To debug, swap the runtime to gcr.io/distroless/static-debian12:debug
14#     which includes busybox
15# =============================================================================
16
17# ---------------------------------------------------------------------------
18# Stage 1: Build
19# ---------------------------------------------------------------------------
20# Base: current stable Go. See references/base-images.md.
21FROM golang:<LATEST_STABLE_GO>-alpine AS build
22
23WORKDIR /src
24
25# Layer caching: download module dependencies before copying source.
26# This layer is only rebuilt when go.mod or go.sum changes.
27COPY go.mod go.sum ./
28
29RUN go mod download && go mod verify
30
31# Copy source and compile a static binary
32COPY . .
33
34RUN CGO_ENABLED=0 GOOS=linux \
35    go build -ldflags="-s -w" -o /bin/app ./cmd/app
36
37# ---------------------------------------------------------------------------
38# Stage 2: Runtime
39# ---------------------------------------------------------------------------
40FROM gcr.io/distroless/static-debian12
41
42# Copy the compiled binary from the build stage
43COPY --from=build /bin/app /app
44
45# AKS Deployment Safeguards DS004: run as non-root.
46# 65534 is the "nobody" user in distroless images.
47USER 65534
48
49EXPOSE 8080
50
51# Distroless has no shell, curl, or wget. Kubernetes liveness/readiness probes
52# (configured in deployment.yaml) handle health checking in AKS.
53# For local Docker usage, consider adding a /healthz handler and using a
54# statically-compiled health check binary, or swap to the :debug variant.
55
56ENTRYPOINT ["/app"]