┌───────────────┐ │ Source Code │ └──────┬────────┘ │ ▼ ┌───────────────┐ │ go.mod/sum │ └──────┬────────┘ │ ▼ ┌──────────────────────┐ │ go mod download │ │ (dependency layer) │ └──────┬───────────────┘ │ ▼ ┌──────────────────────┐ │ go build │ │ (compile layer) │ └──────┬───────────────┘ │ ▼ ┌──────────────────────┐ │ Final Image │ │ (distroless/scratch) │ └──────────────────────┘
┌───────────────┐ │ Source Code │ └──────┬────────┘ │ ▼ ┌───────────────┐ │ go.mod/sum │ └──────┬────────┘ │ ▼ ┌──────────────────────┐ │ go mod download │ │ (dependency layer) │ └──────┬───────────────┘ │ ▼ ┌──────────────────────┐ │ go build │ │ (compile layer) │ └──────┬───────────────┘ │ ▼ ┌──────────────────────┐ │ Final Image │ │ (distroless/scratch) │ └──────────────────────┘
┌───────────────┐ │ Source Code │ └──────┬────────┘ │ ▼ ┌───────────────┐ │ go.mod/sum │ └──────┬────────┘ │ ▼ ┌──────────────────────┐ │ go mod download │ │ (dependency layer) │ └──────┬───────────────┘ │ ▼ ┌──────────────────────┐ │ go build │ │ (compile layer) │ └──────┬───────────────┘ │ ▼ ┌──────────────────────┐ │ Final Image │ │ (distroless/scratch) │ └──────────────────────┘
go build -trimpath -o app
go build -trimpath -o app
go build -trimpath -o app
go mod download
go mod download
go mod download
GOPROXY=https://proxy.golang.org
GONOSUMDB=*
GOPROXY=https://proxy.golang.org
GONOSUMDB=*
GOPROXY=https://proxy.golang.org
GONOSUMDB=*
FROM golang:1.26 AS builder ENV CGO_ENABLED=0 WORKDIR /app COPY go.mod go.sum ./
RUN go mod download COPY . .
RUN go build -trimpath -ldflags="-s -w" -o app
FROM golang:1.26 AS builder ENV CGO_ENABLED=0 WORKDIR /app COPY go.mod go.sum ./
RUN go mod download COPY . .
RUN go build -trimpath -ldflags="-s -w" -o app
FROM golang:1.26 AS builder ENV CGO_ENABLED=0 WORKDIR /app COPY go.mod go.sum ./
RUN go mod download COPY . .
RUN go build -trimpath -ldflags="-s -w" -o app
┌──────────────┐ │ Source │ └──────┬───────┘ │ ┌────────────┴────────────┐ ▼ ▼
┌──────────────┐ ┌──────────────┐
│ linux/amd64 │ │ linux/arm64 │
└──────┬───────┘ └──────┬───────┘ ▼ ▼ Binary A Binary B (different hash) (different hash)
┌──────────────┐ │ Source │ └──────┬───────┘ │ ┌────────────┴────────────┐ ▼ ▼
┌──────────────┐ ┌──────────────┐
│ linux/amd64 │ │ linux/arm64 │
└──────┬───────┘ └──────┬───────┘ ▼ ▼ Binary A Binary B (different hash) (different hash)
┌──────────────┐ │ Source │ └──────┬───────┘ │ ┌────────────┴────────────┐ ▼ ▼
┌──────────────┐ ┌──────────────┐
│ linux/amd64 │ │ linux/arm64 │
└──────┬───────┘ └──────┬───────┘ ▼ ▼ Binary A Binary B (different hash) (different hash)
Layer 1: OS Base Image
Layer 2: go.mod / go.sum
Layer 3: Dependencies (go mod download)
Layer 4: Source Code
Layer 5: Build Output
Layer 1: OS Base Image
Layer 2: go.mod / go.sum
Layer 3: Dependencies (go mod download)
Layer 4: Source Code
Layer 5: Build Output
Layer 1: OS Base Image
Layer 2: go.mod / go.sum
Layer 3: Dependencies (go mod download)
Layer 4: Source Code
Layer 5: Build Output
Change in go.mod ↓
Layer 2 invalidated ↓
Layer 3 re-runs (slow) ↓
Everything rebuilds
Change in go.mod ↓
Layer 2 invalidated ↓
Layer 3 re-runs (slow) ↓
Everything rebuilds
Change in go.mod ↓
Layer 2 invalidated ↓
Layer 3 re-runs (slow) ↓
Everything rebuilds
┌──────────────┐ │ go.mod/sum │ └──────┬───────┘ ▼ (cached via BuildKit mount) ▼ Dependencies reused ✅ ┌──────────────┐ │ Source Code │ └──────┬───────┘ ▼ Build runs faster ⚡
┌──────────────┐ │ go.mod/sum │ └──────┬───────┘ ▼ (cached via BuildKit mount) ▼ Dependencies reused ✅ ┌──────────────┐ │ Source Code │ └──────┬───────┘ ▼ Build runs faster ⚡
┌──────────────┐ │ go.mod/sum │ └──────┬───────┘ ▼ (cached via BuildKit mount) ▼ Dependencies reused ✅ ┌──────────────┐ │ Source Code │ └──────┬───────┘ ▼ Build runs faster ⚡
RUN --mount=type=cache,target=/go/pkg/mod \ go mod download
RUN --mount=type=cache,target=/go/pkg/mod \ go mod download
RUN --mount=type=cache,target=/go/pkg/mod \ go mod download
RUN --mount=type=cache,target=/root/.cache/go-build \ go build -trimpath -ldflags="-s -w" -o app
RUN --mount=type=cache,target=/root/.cache/go-build \ go build -trimpath -ldflags="-s -w" -o app
RUN --mount=type=cache,target=/root/.cache/go-build \ go build -trimpath -ldflags="-s -w" -o app
COPY services/service-a/go.mod services/service-a/go.sum ./
RUN go mod download
COPY services/service-a/go.mod services/service-a/go.sum ./
RUN go mod download
COPY services/service-a/go.mod services/service-a/go.sum ./
RUN go mod download
scratch → smallest → hardest to debug ❌
distroless → balanced → production-ready ✅
alpine → larger → easiest debugging 🔧
scratch → smallest → hardest to debug ❌
distroless → balanced → production-ready ✅
alpine → larger → easiest debugging 🔧
scratch → smallest → hardest to debug ❌
distroless → balanced → production-ready ✅
alpine → larger → easiest debugging 🔧
Production → distroless
Debug build → alpine
Special case → scratch
Production → distroless
Debug build → alpine
Special case → scratch
Production → distroless
Debug build → alpine
Special case → scratch
FROM golang:1.26 AS builder WORKDIR /app ENV CGO_ENABLED=0 COPY go.mod go.sum ./ RUN --mount=type=cache,target=/go/pkg/mod \ go mod download COPY . . RUN --mount=type=cache,target=/root/.cache/go-build \ go build \ -trimpath \ -ldflags="-s -w" \ -o app FROM gcr.io/distroless/base-debian12 WORKDIR / COPY --from=builder /app/app /app USER nonroot:nonroot ENTRYPOINT ["/app"]
FROM golang:1.26 AS builder WORKDIR /app ENV CGO_ENABLED=0 COPY go.mod go.sum ./ RUN --mount=type=cache,target=/go/pkg/mod \ go mod download COPY . . RUN --mount=type=cache,target=/root/.cache/go-build \ go build \ -trimpath \ -ldflags="-s -w" \ -o app FROM gcr.io/distroless/base-debian12 WORKDIR / COPY --from=builder /app/app /app USER nonroot:nonroot ENTRYPOINT ["/app"]
FROM golang:1.26 AS builder WORKDIR /app ENV CGO_ENABLED=0 COPY go.mod go.sum ./ RUN --mount=type=cache,target=/go/pkg/mod \ go mod download COPY . . RUN --mount=type=cache,target=/root/.cache/go-build \ go build \ -trimpath \ -ldflags="-s -w" \ -o app FROM gcr.io/distroless/base-debian12 WORKDIR / COPY --from=builder /app/app /app USER nonroot:nonroot ENTRYPOINT ["/app"]
FROM alpine:3.19 RUN apk add --no-cache ca-certificates COPY --from=builder /app/app /app ENTRYPOINT ["/app"]
FROM alpine:3.19 RUN apk add --no-cache ca-certificates COPY --from=builder /app/app /app ENTRYPOINT ["/app"]
FROM alpine:3.19 RUN apk add --no-cache ca-certificates COPY --from=builder /app/app /app ENTRYPOINT ["/app"]
Reproducibility → Can I trust this build?
Debuggability → Can I fix issues fast?
Performance → Can CI scale?
Reproducibility → Can I trust this build?
Debuggability → Can I fix issues fast?
Performance → Can CI scale?
Reproducibility → Can I trust this build?
Debuggability → Can I fix issues fast?
Performance → Can CI scale? - CI pipelines slow down unpredictably
- Builds stop being reproducible
- Debugging minimal containers becomes painful
- Monorepos destroy Docker cache efficiency - Different architectures (amd64 vs arm64)
- Embedded file paths
- Environment-dependent outputs - No TLS certs → HTTPS fails
- No shell → cannot debug
- No timezone/DNS tools - Secure and minimal
- But still no shell - But uses musl libc (can cause subtle issues) - Build completion - hard to debug - dependencies
- and runtime assumptions
