Dockerfile

# Dockerfile from https://github.com/chemidy/smallest-secured-golang-docker-image

##################################
# STEP 1 build executable binary #
##################################

FROM golang AS builder

# Install git + SSL ca certificates.
# Git is required for fetching the dependencies.
# Ca-certificates is required to call HTTPS endpoints.
RUN apt-get update && apt-get install -y git ca-certificates tzdata libcap2-bin mailcap curl && update-ca-certificates

# Create appuser
ENV USER=appuser
ENV UID=1000
# See https://stackoverflow.com/a/55757473/12429735
RUN adduser \
    --disabled-password \
    --gecos "" \
    --home "/nonexistent" \
    --shell "/sbin/nologin" \
    --no-create-home \
    --uid "${UID}" \
    "${USER}"

WORKDIR /app

ADD . .

# Get dependencies and run tests
RUN go version
RUN go get -d -v
RUN CGO_ENABLED=1 go test ./...

# Build the binary
RUN CGO_ENABLED=0 go build \
    -ldflags='-w -s -extldflags "-static"' -a \
    -o /app/backoffice-server .

RUN mkdir -p /app/mnt /app/mnt/configs

RUN chown -Rf "${UID}" ./*

# Allow running on ports < 1000
# RUN setcap cap_net_bind_service=+ep /app/backoffice-server

##############################
# STEP 2 build a small image #
##############################
FROM curlimages/curl:8.11.0

WORKDIR /app

# Import global resources from builder
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /etc/passwd /etc/passwd
COPY --from=builder /etc/group /etc/group
COPY --from=builder /etc/mime.types /etc/mime.types

# Copy static executable and application resources
COPY --from=builder /app/backoffice-server /app/backoffice-server
COPY --from=builder /app/dev_certificates /app/dev_certificates
COPY --from=builder /app/mnt/configs /app/mnt/configs

# Use an unprivileged user.
USER appuser:appuser

# Run the binary
ENTRYPOINT ["./backoffice-server"]