Skip to content

Commit 86acf99

Browse files
chemidychemidy
authored
Merge pull request #9 from StevenACoffman/master
Add static distroless and specify uid/gid for alpine static
2 parents 6eb3864 + f168196 commit 86acf99

File tree

10 files changed

+183
-24
lines changed

10 files changed

+183
-24
lines changed

‎Dockerfile

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,35 @@
33
############################
44
# golang alpine 1.13.5
55
FROM golang@sha256:0991060a1447cf648bab7f6bb60335d1243930e38420bee8fec3db1267b84cfa as builder
6+
67
# Install git + SSL ca certificates.
78
# Git is required for fetching the dependencies.
89
# Ca-certificates is required to call HTTPS endpoints.
910
RUN apk update && apk add --no-cache git ca-certificates tzdata && update-ca-certificates
1011

1112
# Create appuser
12-
RUN adduser -D -g '' appuser
13-
13+
ENV USER=appuser
14+
ENV UID=10001
15+
16+
# See https://stackoverflow.com/a/55757473/12429735
17+
RUN adduser \
18+
--disabled-password \
19+
--gecos "" \
20+
--home "/nonexistent" \
21+
--shell "/sbin/nologin" \
22+
--no-create-home \
23+
--uid "${UID}" \
24+
"${USER}"
1425
WORKDIR $GOPATH/src/mypackage/myapp/
1526
COPY . .
1627

1728
# Fetch dependencies.
1829
RUN go get -d -v
1930

2031
# Build the binary
21-
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -a -installsuffix cgo -o /go/bin/hello .
32+
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
33+
-ldflags='-w -s -extldflags "-static"' -a \
34+
-o /go/bin/hello .
2235

2336
############################
2437
# STEP 2 build a small image
@@ -29,12 +42,13 @@ FROM scratch
2942
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
3043
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
3144
COPY --from=builder /etc/passwd /etc/passwd
45+
COPY --from=builder /etc/group /etc/group
3246

3347
# Copy our static executable
3448
COPY --from=builder /go/bin/hello /go/bin/hello
3549

3650
# Use an unprivileged user.
37-
USER appuser
51+
USER appuser:appuser
3852

3953
# Run the hello binary.
4054
ENTRYPOINT ["/go/bin/hello"]

‎go_module/Dockerfile

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,18 @@ FROM golang@sha256:0991060a1447cf648bab7f6bb60335d1243930e38420bee8fec3db1267b84
1010
RUN apk update && apk add --no-cache git ca-certificates tzdata && update-ca-certificates
1111

1212
# Create appuser
13-
RUN adduser -D -g '' appuser
13+
ENV USER=appuser
14+
ENV UID=10001
15+
16+
# See https://stackoverflow.com/a/55757473/12429735
17+
RUN adduser \
18+
--disabled-password \
19+
--gecos "" \
20+
--home "/nonexistent" \
21+
--shell "/sbin/nologin" \
22+
--no-create-home \
23+
--uid "${UID}" \
24+
"${USER}"
1425
WORKDIR $GOPATH/src/mypackage/myapp/
1526

1627
# use modules
@@ -23,7 +34,9 @@ RUN go mod verify
2334
COPY . .
2435

2536
# Build the binary
26-
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -a -installsuffix cgo -o /go/bin/hello .
37+
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
38+
-ldflags='-w -s -extldflags "-static"' -a \
39+
-o /go/bin/hello .
2740

2841
############################
2942
# STEP 2 build a small image
@@ -34,12 +47,13 @@ FROM scratch
3447
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
3548
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
3649
COPY --from=builder /etc/passwd /etc/passwd
50+
COPY --from=builder /etc/group /etc/group
3751

3852
# Copy our static executable
3953
COPY --from=builder /go/bin/hello /go/bin/hello
4054

4155
# Use an unprivileged user.
42-
USER appuser
56+
USER appuser:appuser
4357

4458
# Run the hello binary.
4559
ENTRYPOINT ["/go/bin/hello"]

‎go_module_distroless/Dockerfile

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,13 @@
11
############################
22
# STEP 1 build executable binary
33
############################
4-
# golang alpine 1.13.5
5-
FROM golang@sha256:0991060a1447cf648bab7f6bb60335d1243930e38420bee8fec3db1267b84cfa as builder
4+
# golang debian buster 1.13.6 linux/amd64
5+
# https://github.com/docker-library/golang/blob/master/1.13/buster/Dockerfile
6+
FROM golang@sha256:93a56423351235e070b3630e0a8b3e27d5e868883d4dff591f676315f208a574 as builder
67

7-
# Install git + SSL ca certificates.
8-
# Git is required for fetching the dependencies.
9-
# Ca-certificates is required to call HTTPS endpoints.
10-
RUN apk update && apk add --no-cache git ca-certificates tzdata && update-ca-certificates
8+
# Ensure ca-certficates are up to date
9+
RUN update-ca-certificates
1110

12-
# Create appuser
13-
RUN adduser -D -g '' appuser
1411
WORKDIR $GOPATH/src/mypackage/myapp/
1512

1613
# use modules
@@ -28,8 +25,9 @@ RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -a -installsuffix cgo -o
2825
############################
2926
# STEP 2 build a small image
3027
############################
31-
#using nonroot image
32-
FROM gcr.io/distroless/static@sha256:08322afd57db6c2fd7a4264bf0edd9913176835585493144ee9ffe0c8b576a76
28+
# using base nonroot image
29+
# user:group is nobody:nobody, uid:gid = 65534:65534
30+
FROM gcr.io/distroless/base@sha256:2b177fbc9a31b85254d264e1fc9a65accc6636d6f1033631b9b086ee589d1fe2
3331

3432
# Copy our static executable
3533
COPY --from=builder /go/bin/hello /go/bin/hello

‎go_module_distroless/Makefile

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ help: ## - Show help message
88
@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
99

1010
.PHONY: build
11-
build: ## - Build the smallest and secured golang docker image based on scratch
12-
@printf "\033[32m\xE2\x9c\x93 Build the smallest and secured golang docker image based on scratch\n\033[0m"
11+
build: ## - Build the smallest and secured golang docker image based on distroless
12+
@printf "\033[32m\xE2\x9c\x93 Build the smallest and secured golang docker image based on distroless\n\033[0m"
1313
@export DOCKER_CONTENT_TRUST=1 && docker build -f Dockerfile -t smallest-secured-golang-distroless .
1414

1515
.PHONY: build-no-cache
@@ -23,7 +23,7 @@ ls: ## - List 'smallest-secured-golang' docker images
2323
@docker image ls smallest-secured-golang-distroless
2424

2525
.PHONY: run
26-
run: ## - Run the smallest and secured golang docker image based on scratch
26+
run: ## - Run the smallest and secured golang docker image based on distroless
2727
@printf "\033[32m\xE2\x9c\x93 Run the smallest and secured golang docker image based on scratch\n\033[0m"
2828
@docker run smallest-secured-golang-distroless:latest
2929

‎go_module_distroless/README.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
1-
# Create the smallest secured golang docker image base on scratch
1+
# Create the smallest secured golang docker image base on distroless
22

33
Read the related article : [Create the smallest and secured golang docker image based on scratch](https://medium.com/@chemidy/create-the-smallest-and-secured-golang-docker-image-based-on-scratch-4752223b7324)
44

55
```
66
✓ usage: make [target]
77
8-
build-no-cache - Build the smallest and secured golang docker image based on scratch with no cache
9-
build - Build the smallest and secured golang docker image based on scratch
8+
build-no-cache - Build the smallest and secured golang docker image based on distroless with no cache
9+
build - Build the smallest and secured golang docker image based on distroless
1010
help - Show help message
1111
ls - List 'smallest-secured-golang' docker images
1212
push-to-azure - Push docker image to azurecr.io container registry
1313
push-to-gcp - Push docker image to gcr.io container registry
14-
run - Run the smallest and secured golang docker image based on scratch
14+
run - Run the smallest and secured golang docker image based on distroless
1515
```
1616

1717
# Quickstart

‎go_module_distroless_static/Dockerfile

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
############################
2+
# STEP 1 build executable binary
3+
############################
4+
# golang debian buster 1.13.6 linux/amd64
5+
# https://github.com/docker-library/golang/blob/master/1.13/buster/Dockerfile
6+
FROM golang@sha256:93a56423351235e070b3630e0a8b3e27d5e868883d4dff591f676315f208a574 as builder
7+
8+
# Ensure ca-certficates are up to date
9+
RUN update-ca-certificates
10+
11+
WORKDIR $GOPATH/src/mypackage/myapp/
12+
13+
# use modules
14+
COPY go.mod .
15+
16+
ENV GO111MODULE=on
17+
RUN go mod download
18+
RUN go mod verify
19+
20+
COPY . .
21+
22+
# Build the static binary
23+
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
24+
-ldflags='-w -s -extldflags "-static"' -a \
25+
-o /go/bin/hello .
26+
27+
############################
28+
# STEP 2 build a small image
29+
############################
30+
# using static nonroot image
31+
# user:group is nobody:nobody, uid:gid = 65534:65534
32+
FROM gcr.io/distroless/static@sha256:08322afd57db6c2fd7a4264bf0edd9913176835585493144ee9ffe0c8b576a76
33+
34+
# Copy our static executable
35+
COPY --from=builder /go/bin/hello /go/bin/hello
36+
37+
# Run the hello binary.
38+
ENTRYPOINT ["/go/bin/hello"]

‎go_module_distroless_static/Makefile

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
VERSION=`git rev-parse HEAD`
2+
BUILD=`date +%FT%T%z`
3+
LDFLAGS=-ldflags "-X main.Version=${VERSION} -X main.Build=${BUILD}"
4+
5+
.PHONY: help
6+
help: ## - Show help message
7+
@printf "\033[32m\xE2\x9c\x93 usage: make [target]\n\n\033[0m"
8+
@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
9+
10+
.PHONY: build
11+
build: ## - Build the smallest and secured golang docker image based on distroless static
12+
@printf "\033[32m\xE2\x9c\x93 Build the smallest and secured golang docker image based on distroless static\n\033[0m"
13+
@export DOCKER_CONTENT_TRUST=1 && docker build -f Dockerfile -t smallest-secured-golang-distroless-static .
14+
15+
.PHONY: build-no-cache
16+
build-no-cache: ## - Build the smallest and secured golang docker image based on scratch with no cache
17+
@printf "\033[32m\xE2\x9c\x93 Build the smallest and secured golang docker image based on scratch\n\033[0m"
18+
@export DOCKER_CONTENT_TRUST=1 && docker build --no-cache -f Dockerfile -t smallest-secured-golang-distroless-static .
19+
20+
.PHONY: ls
21+
ls: ## - List 'smallest-secured-golang' docker images
22+
@printf "\033[32m\xE2\x9c\x93 Look at the size dude !\n\033[0m"
23+
@docker image ls smallest-secured-golang-distroless-static
24+
25+
.PHONY: run
26+
run: ## - Run the smallest and secured golang docker image based on distroless static
27+
@printf "\033[32m\xE2\x9c\x93 Run the smallest and secured golang docker image based on scratch\n\033[0m"
28+
@docker run smallest-secured-golang-distroless-static:latest
29+
30+
.PHONY: push-to-azure
31+
push-to-azure: ## - Push docker image to azurecr.io container registry
32+
@az acr login --name chemidy
33+
@docker push chemidy.azurecr.io/smallest-secured-golang-docker-image:$(VERSION)
34+
35+
.PHONY: push-to-gcp
36+
push-to-gcp: ## - Push docker image to gcr.io container registry
37+
@gcloud auth application-default login
38+
@gcloud auth configure-docker
39+
@docker push gcr.io/chemidy/smallest-secured-golang-docker-image:$(VERSION)

‎go_module_distroless_static/README.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Create the smallest secured golang docker image base on distroless static
2+
3+
Read the related article : [Create the smallest and secured golang docker image based on scratch](https://medium.com/@chemidy/create-the-smallest-and-secured-golang-docker-image-based-on-scratch-4752223b7324)
4+
5+
```
6+
✓ usage: make [target]
7+
8+
build-no-cache - Build the smallest and secured golang docker image based on distroless static with no cache
9+
build - Build the smallest and secured golang docker image based on distroless static
10+
help - Show help message
11+
ls - List 'smallest-secured-golang-distroless-static' docker images
12+
push-to-azure - Push docker image to azurecr.io container registry
13+
push-to-gcp - Push docker image to gcr.io container registry
14+
run - Run the smallest and secured golang docker image based on distroless static
15+
```
16+
17+
# Quickstart
18+
19+
```
20+
make build && make run
21+
```

‎go_module_distroless_static/go.mod

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
module github.com/chemidy/smallest-secured-golang-docker-image/go_module
2+
3+
go 1.12

‎go_module_distroless_static/main.go

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
package main
2+
3+
import (
4+
"fmt"
5+
"net/http"
6+
"time"
7+
)
8+
9+
func checkWebsite(website string) error {
10+
11+
tz, _ := time.LoadLocation("Europe/Paris")
12+
now := time.Now()
13+
parisTime := now.In(tz)
14+
15+
resp, err := http.Get(website)
16+
if err != nil {
17+
return err
18+
}
19+
20+
if resp.StatusCode >= 200 && resp.StatusCode <= 299 {
21+
fmt.Println("Website :", website, "is Up", "HTTP Response Status:", resp.StatusCode, http.StatusText(resp.StatusCode))
22+
} else {
23+
fmt.Println("Website :", website, " Broken", "HTTP Response Status:", resp.StatusCode, http.StatusText(resp.StatusCode))
24+
}
25+
fmt.Println("Paris is magic : what time is it in Paris ?", parisTime)
26+
27+
return err
28+
}
29+
30+
func main() {
31+
checkWebsite("https://chemidy.cloud")
32+
}

0 commit comments

Comments
 (0)