What build flags should I use for minimal Go binaries?

Use -ldflags='-w -s' to strip DWARF debug information and the symbol table, and -trimpath to remove local file system paths from the binary for better security and reproducibility.

Can I use the 'scratch' base image if my app uses CGO?

Usually no. CGO requires C libraries (like musl or glibc). If you need CGO, a minimal Alpine Linux image is the recommended base, though you can still use multi-stage builds to keep the size under 20MB.

How does Go achieve such small container images?

Go can compile into a single static binary with no external dependencies. This allows you to use a 'scratch' base image, which is an empty 0MB starting point, resulting in a final image that is only the size of your binary (typically 2-10MB).

Is 'distroless' better than 'scratch'?

Distroless is slightly larger (adds ~2-3MB) but is often easier because it includes CA certificates, time zone data, and basic user configurations while still maintaining a high security posture by excluding shells and package managers.

Go Container Optimization

Name: Go Container Optimization
Author: laurigates

bylaurigates

•

Deployment & DevOps

Optimizes Go application container images using static compilation, minimal base images, and binary stripping to achieve a minimal footprint and maximum security.

About

This skill provides specialized expertise for building high-performance, ultra-minimal Go container images. It guides developers through a systematic reduction of image sizes—often achieving a 99% reduction—by leveraging multi-stage builds, static binary compilation, and the transition to 'scratch' or 'distroless' base images. The skill covers advanced build flag configurations like ldflags and trimpath, ensures proper handling of CA certificates for HTTPS, and provides specific patterns for managing CGO dependencies in restricted environments.

Key Features

Implementation patterns for Scratch and Distroless base images
3 GitHub stars
Systematic image size reduction from ~850MB to ~2.5MB
Advanced CGO handling and cross-compilation optimization
Static binary compilation and binary stripping using -ldflags='-w -s'
Security hardening by removing shells, utilities, and package managers

Use Cases

Eliminating container vulnerabilities (CVEs) by removing the underlying operating system
Shrinking production Go Docker images to reduce storage costs and deployment times
Configuring optimized multi-stage builds for complex Go applications with C dependencies

About

Key Features

Implementation patterns for Scratch and Distroless base images
3 GitHub stars
Systematic image size reduction from ~850MB to ~2.5MB
Advanced CGO handling and cross-compilation optimization
Static binary compilation and binary stripping using -ldflags='-w -s'
Security hardening by removing shells, utilities, and package managers

Use Cases

Eliminating container vulnerabilities (CVEs) by removing the underlying operating system
Shrinking production Go Docker images to reduce storage costs and deployment times
Configuring optimized multi-stage builds for complex Go applications with C dependencies