Build a Go app

Go is the cleanest case for multi-stage builds. A Go program compiles to a single static binary, so the runtime image needs nothing but that file. Build on the go image, copy the binary onto static, and the final image is little more than your program: no toolchain, no shell, no package manager.

This builds on ghcr.io/quenchworks/images/go:1.25 and ghcr.io/quenchworks/images/static. The static image is the one image in the catalog tagged :latest, because it carries no language version of its own.

The two-stage Dockerfile

1
# Build stage: compile a fully static binary.
2
FROM ghcr.io/quenchworks/images/go:1.25 AS build
3
WORKDIR /src
4

5
# CGO off makes the binary static so it runs on the static base with no libc.
6
# The root filesystem is read-only, so point the build caches at /tmp.
7
ENV CGO_ENABLED=0 \
8
    GOOS=linux \
9
    GOCACHE=/tmp/gocache \
10
    GOMODCACHE=/tmp/gomodcache
11

12
# Download modules first so the layer caches when only code changes.
13
COPY go.mod go.sum ./
14
RUN ["go", "mod", "download"]
15
COPY . .
16
RUN ["go", "build", "-trimpath", "-ldflags=-s -w", "-o", "/out/app", "./cmd/app"]
17

18
# Runtime stage: just the binary on the tiny static base.
19
FROM ghcr.io/quenchworks/images/static
20
COPY --from=build /out/app /app
21
USER 1001
22
EXPOSE 8080
23
ENTRYPOINT ["/app"]

Why this stays tiny

Next

• The same static base works for any language that compiles to a static binary, Rust included; build with ghcr.io/quenchworks/images/rust and copy the binary over.
• Pin by digest so each build runs exactly the base that was scanned and signed.