Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

use docker multi stage build #2

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

use docker multi stage build #2

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4ae39e4
use docker multi stage build
Anakin100100 Apr 28, 2022
7387374
make the workflow run on all pull requests
Anakin100100 Apr 28, 2022
a3344a3
make docker cache dependencies
Anakin100100 Apr 29, 2022
3c35fd3
run on push to main branch and on pull requests
Anakin100100 Apr 29, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 5 additions & 8 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,13 @@
FROM golang:1.18
FROM golang:1.18 as builder

RUN mkdir /app
WORKDIR /app

COPY go.mod ./
COPY go.sum ./
RUN go mod download
Anakin100100 marked this conversation as resolved.
Show resolved Hide resolved

COPY . .
RUN CGO_ENABLED=0 go build -o geralt

RUN go build -o /geralt

FROM alpine:3.15
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alpine is a very risky choice and has proven to have an illusion of security, I think Debian makes more sense in this case.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BTW default golang image is based on Debian and I think it's not an accidental choice.

Copy link
Author

@Anakin100100 Anakin100100 Apr 29, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When introducing this change I was thinking more about the resulting image size than security. The final build using pure alpine (without go etc.) is only 16mb while the image resulting from go-1.18 was about 1.1gb in size. Though the debian image is fairly coveniat for running tests. Do you know whether GCP docker registry caches the layers of the base image? If this is the case, the cost effectivness of debian and alpine images would be the same except the base image size. Do you know if the image size affects the cold startup time? In this post the author says that it does not but I couldn't find another confirmation of that.

Copy link
Author

@Anakin100100 Anakin100100 Apr 29, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wasn't aware that alpine was unsafe and thought that it was best to use as minimal image as possible for security to decrease the number of attack vectors. Could you show me some examples? I'd like to read up on that.

COPY --from=builder /app/geralt /
EXPOSE 8080

CMD [ "/geralt" ]
CMD ["/geralt"]