go-containers

# Go Container Optimization

Expert knowledge for building minimal, secure Go container images using static compilation, scratch/distroless base images, and Go-specific build optimizations.

## Core Expertise

**Go's Unique Advantages**:
- Compiles to single static binary (no runtime dependencies)
- Can run on `scratch` base (literally empty image)
- No interpreter, VM, or system libraries needed at runtime
- Enables smallest possible container images (2-5MB)

**Key Capabilities**:
- Static binary compilation with CGO_ENABLED=0
- Binary stripping with ldflags (-w, -s)
- Scratch and distroless base images
- CA certificate handling for HTTPS
- CGO considerations when C libraries are required

## The Optimization Journey: 846MB → 2.5MB

This demonstrates systematic optimization achieving 99.7% size reduction:

### Step 1: The Problem - Full Debian Base (846MB)

```dockerfile
# ❌ BAD: Includes full Go toolchain, Debian system, unnecessary tools
FROM golang:1.23
WORKDIR /app
COPY . .
RUN go build -o main .
EXPOSE 8080
CMD ["./main"]
```

**Issues**:
- Full Debian base (~116MB)
- Complete Go compiler and toolchain (~730MB)
- System libraries, package managers, shells
- None of this is needed at runtime

**Image size: 846MB**

### Step 2: Switch to Alpine (312MB)

```dockerfile
# ✅ BETTER: Alpine reduces OS overhead
FROM golang:1.23-alpine
WORKDIR /app
COPY . .
RUN go build -o main .
EXPOSE 8080
CMD ["./main"]
```

**Improvements**:
- Alpine Linux (~5MB base vs ~116MB Debian)
- Still includes full Go toolchain (unnecessary at runtime)

**Image size: 312MB** (63% reduction)

### Step 3: Multi-Stage Build (15MB)

```dockerfile
# ✅ GOOD: Separate build from runtime
# Build stage
FROM golang:1.23-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN go build -o main .

# Runtime stage
FROM alpine:latest
WORKDIR /app
COPY --from=builder /app/main .
EXPOSE 8080
CMD ["./main"]
```

**Improvements**:
- Build artifacts excluded from final image
- Onl