Snippets / Dockerfile
Go app (multi-stage, distroless)
Compiles a static Go binary, then ships it on a distroless base with no shell or package manager.
gomulti-stagedistroless
Dockerfile
# --- build ---
FROM golang:1.23 AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
# CGO_ENABLED=0 produces a fully static binary with no libc dependency --
# required for it to run at all on a base image with no shared libraries.
RUN CGO_ENABLED=0 GOOS=linux go build -o /app ./cmd/server
# --- runtime ---
# distroless/static has no shell, no package manager, and no libc --
# just enough to run a static binary, which shrinks both the image and
# the attack surface if the container is ever compromised.
FROM gcr.io/distroless/static-debian12
COPY /app /app
EXPOSE 8080
ENTRYPOINT ["/app"]
More dockerfile snippets