Distroless images concept in Docker - Mini Project: Build & Apply

Using Distroless Images in Docker

📖 Scenario: You are working on a small web application that you want to deploy using Docker. To make your application image smaller and more secure, you decide to use a distroless image instead of a full Linux base image.Distroless images contain only the application and its runtime dependencies, without a package manager or shell. This reduces the image size and attack surface.

🎯 Goal: Build a Docker image for a simple Go web server using a distroless base image. You will create a Dockerfile that compiles the Go app and then uses a distroless image to run it.

📋 What You'll Learn

Create a Go source file named main.go with a simple HTTP server.

Write a multi-stage Dockerfile that first builds the Go app using the official Go image.

Use the gcr.io/distroless/base image as the final base image to run the compiled binary.

Expose port 8080 in the Dockerfile.

Run the Go binary as the container's entrypoint.

💡 Why This Matters

🌍 Real World

Distroless images are used in production to reduce Docker image size and improve security by removing unnecessary OS components.

💼 Career

Understanding distroless images is important for DevOps engineers and developers who want to optimize container images for cloud deployments.

1

Create the Go web server source file

Create a file named main.go with a simple HTTP server that listens on port 8080 and responds with "Hello, Distroless!" to any request.

Docker

# Your code here

Need a hint?

Use the net/http package to create a simple web server. The handler should write "Hello, Distroless!" to the response.

2

Start the Dockerfile with the Go build stage

Create a Dockerfile that starts with the official Go image golang:1.20 as the build stage named builder. Copy main.go into the container and build the binary named app using go build -o app main.go.

Docker

package main

import (
	"fmt"
	"net/http"
)

func handler(w http.ResponseWriter, r *http.Request) {
	fmt.Fprintln(w, "Hello, Distroless!")
}

func main() {
	http.HandleFunc("/", handler)
	http.ListenAndServe(":8080", nil)
}

# Your Dockerfile build stage here

Need a hint?

Use a multi-stage build. The first stage uses golang:1.20. Set working directory to /app. Copy main.go and build the binary app.

3

Add the distroless base image and copy the binary

In the same Dockerfile, add a final stage that uses the distroless base image gcr.io/distroless/base. Copy the app binary from the builder stage to /app in the final image. Expose port 8080 and set the entrypoint to run /app.

Docker

# Add final distroless stage below

Need a hint?

The final image uses gcr.io/distroless/base. Copy the binary from the builder stage. Expose port 8080 and set the entrypoint to /app.

4

Build and run the Docker image

Build the Docker image with tag distroless-go using docker build -t distroless-go .. Then run the container mapping port 8080 with docker run -p 8080:8080 distroless-go. Finally, print the output of curl http://localhost:8080.

Docker

# Run the commands below and print the curl output
# Your code here

Need a hint?

After building and running the container, use curl http://localhost:8080 to see the response. It should print "Hello, Distroless!".