The distroless Dockerfile

A Go agent ships the way a Go program ships: one binary, no runtime, no venv. Dropping it into a distroless image gets you a final image that has the agent and nothing else. No shell inside the container means no interactive remote attack surface.

Dockerfile

dockerfile

FROM golang:1.22 AS build
WORKDIR /src
COPY go.mod ./
RUN go mod download || true
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /out/agent .

FROM gcr.io/distroless/static-debian12:nonroot
WORKDIR /app
COPY --from=build /out/agent /app/agent
USER nonroot:nonroot
ENTRYPOINT ["/app/agent"]

CGO_ENABLED=0 produces a fully static binary. distroless/static has no package manager, no shell, no util-linux. USER nonroot is a cheap defense-in-depth layer.

Matching exercise: What each flag buys you

Loading practice…