Use multi-stage Docker builds to create small, secure images by compiling the Go binary in a builder stage and copying it to a minimal runtime image like Alpine Linux, reducing size and attack surface. 2. Optimize build performance by copying go.mod and go.sum first to leverage Docker layer caching, ensuring dependencies are only re-downloaded when necessary. 3. Build the Go binary with production flags including CGO_ENABLED=0 for static compilation, GOOS=linux for Linux compatibility, and -ldflags="-s -w" to strip debug symbols and reduce binary size. 4. Run the container as a non-root user by creating a dedicated user in the Docker image to minimize security risks. 5. Deploy using Docker Compose for development or testing, and use container registries with orchestration platforms like Kubernetes or ECS for production, ensuring consistent deployment across environments. Additionally, use a .dockerignore file to exclude unnecessary files such as test assets and documentation, keeping the build context minimal and improving build efficiency.

Building and deploying Go applications with Docker is a powerful way to ensure consistency across environments, reduce deployment friction, and simplify dependency management. Go’s statically compiled binaries pair exceptionally well with Docker’s lightweight container model. Here’s how to do it effectively.

1. Use Multi-Stage Builds for Smaller, Secure Images

One of the best practices when Dockerizing Go apps is using multi-stage builds. This lets you compile your Go binary in one stage (with the full Go SDK) and then copy only the final binary into a minimal runtime image.

# Stage 1: Build the Go binary
FROM golang:1.22 AS builder

WORKDIR /app

# Copy go mod files and download dependencies
COPY go.mod go.sum ./
RUN go mod download

# Copy source code
COPY . .

# Build the binary (disable CGO for full static compilation)
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o main ./cmd/api

# Stage 2: Minimal runtime image
FROM alpine:latest
RUN apk --no-cache add ca-certificates
WORKDIR /root/

# Copy the binary from builder stage
COPY --from=builder /app/main .

# Expose port and define command
EXPOSE 8080
CMD ["./main"]

Why this matters:

• The final image is tiny (often under 30MB).
• No Go toolchain or source code is included in production.
• Reduces attack surface and improves startup time.

2. Optimize Build Context and Layer Caching

Docker builds are faster when you structure your COPY instructions to take advantage of layer caching.

• Copy go.mod and go.sum first, then run go mod download. This means Docker will reuse the downloaded modules unless those files change.
• Copy source code afterward so code changes don’t invalidate dependency layers.

COPY go.mod go.sum ./
RUN go mod download

COPY . .

This small optimization saves significant time during CI/CD and local rebuilds.

3. Build for Production with Proper Flags

When building your Go binary for Docker, use flags that optimize for production:

go build -ldflags="-s -w" -o main ./cmd/api

• -ldflags="-s -w" strips debug symbols, reducing binary size.
• CGO_ENABLED=0 ensures a fully static binary (no external dependencies on libc, etc.).
• GOOS=linux ensures the binary is built for Linux (required inside Docker).

Update your Dockerfile accordingly:

RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -ldflags="-s -w" -o main ./cmd/api

4. Run as Non-Root User for Security

Running containers as root is a security risk. Create a non-root user in your final image:

FROM alpine:latest

RUN apk --no-cache add ca-certificates
RUN adduser -D -s /bin/sh appuser

WORKDIR /home/appuser

COPY --from=builder /app/main .
RUN chown -R appuser:appuser ./
USER appuser

EXPOSE 8080
CMD ["./main"]

This ensures your app runs with minimal privileges.

5. Deploy with Docker Compose or Orchestration Tools

For local development or simple deployments, use docker-compose.yml:

version: '3.8'
services:
  api:
    build: .
    ports:
      - "8080:8080"
    environment:
      - ENV=production
    restart: unless-stopped

For production:

• Push the image to a registry (docker push myregistry/myapp:latest)
• Deploy using Kubernetes, ECS, or any container orchestration platform.

Example push and run:

docker build -t myapp:latest .
docker tag myapp:latest myregistry/myapp:latest
docker push myregistry/myapp:latest

# Run locally
docker run -p 8080:8080 myregistry/myapp:latest

Bonus: Leverage .dockerignore

Just like .gitignore, use .dockerignore to exclude unnecessary files from the build context:

.git
.gitignore
README.md
Dockerfile
.dockerignore
*.md
go.mod
go.sum

Wait — don’t ignore go.mod and go.sum if you’re copying them in the Dockerfile. Instead, exclude dev-only assets:

.git
.gitignore
README.md
*.test
*.sh
cmd/**/testdata

This keeps the build context small and speeds up builds.

Basically, combining Go’s simplicity with Docker’s portability gives you fast, secure, and consistent deployments. With multi-stage builds, proper user permissions, and smart layering, your Go services will be production-ready in no time.

The above is the detailed content of Building and Deploying Go Applications with Docker. For more information, please follow other related articles on the PHP Chinese website!