Go 容器化从 Dockerfile 到 distroless 镜像压缩实战容器化是云原生的入门功夫。但 1GB 的 Go 镜像可不是云原生最爱的身材。本文带你从 Dockerfile 到 multistage 实战。一、基础 DockerfileFROM golang:1.22 AS build WORKDIR /src COPY . . RUN go mod download RUN CGO_ENABLED0 GOOSlinux go build -ldflags-s -w -o app FROM debian:bookworm-slim WORKDIR /app COPY --frombuild /src/app /app/app ENTRYPOINT [/app/app]普通 700MB → 用 distroless 30MB二、Multi-stageFROM golang:1.22 AS builder WORKDIR /src COPY . . RUN CGO_ENABLED0 go build -ldflags-s -w -o /out/app FROM gcr.io/distroless/base COPY --frombuilder /out/app /app USER nonroot:nonroot ENTRYPOINT [/app]特点静态链接CGO_ENABLED0不带 shell / libc / debug 工具distroless非 root 用户减少攻击面三、scratch 镜像FROM scratch COPY --frombuilder /out/app /app ENTRYPOINT [/app]scratch 完全空包括基础文件。极少错误排查。四、镜像大小优化优化手段节省-ldflags-s -w5-15%CGO0200MB → 5MBalpine700MB → 200MBdistroless700MB → 50MBscratch700MB → 30MB五、构建缓存COPY go.mod go.sum ./ RUN go mod download COPY . . RUN go build -o app先单独下载 mod提升缓存命中率。六、私有仓库代理dockerbuild --build-argGOPROXYhttps://goproxy.cn-tmyapp.GOPROXY 环境变量跳过 go mod download。七、安全扫描dockerscout cves myapp:tag trivy image myapp:tagtrivy 找高危漏洞。八、健康检查FROM gcr.io/distroless/base HEALTHCHECK --interval30s --timeout3s CMD [/app/health] ENTRYPOINT [/app]K8s 配合 liveness / readiness probe。九、打 tag 技巧dockerbuild-tmyrepo/app:v1.0.0-$(date%Y%m%d%H%M%S)-$(gitrev-parse--shortHEAD).含版本 时间 git sha。十、多架构构建dockerbuildx build--platformlinux/amd64,linux/arm64-tmyrepo/app:latest.ARM / x86 双架构。十一、实战CI 集成-name:Build and pushuses:docker/build-push-actionv4with:context:.push:truetags:|registry.example.com/app:${{ github.sha }} registry.example.com/app:latestcache-from:typeghacache-to:typegha,modemax多 stage cache-from GHA。十二、踩坑清单基础镜像 pin tag——避免 alpine:latest 某天被改adduser 创建非 root 用户时区设置distroless 无时区需 ENV TZ–read-only 容器不允许写盘体积与可调试性 balanceprod 用 distrolessstaging 用 debian-slim十三、调试镜像FROM gcr.io/distroless/base-debian12 AS runtime # 增加 shell 与 ping 等 FROM scratch AS debug COPY --frombusybox:musl /bin/sh /bin/sh COPY --frombuilder /out/app /app区分 runtime / debug 两套镜像。十四、总结与展望distroless multistage CGO0 三件套让 Go 镜像稳定在 30MB 以内。安全、速度、部署效率全面提升。未来Buildpacks、Chao 等无需 Dockerfile 的方式会进一步降低门槛。十五、参考文献Dockerfile 官方文档distroless 仓库Google Cloud Build