Testing locally, adding the "-linkmode external -extldflags '-static'" flags doesn't bring down the binary size. The heavy lifting is done by '-s -w'. It is a g

Testing locally, adding the "-linkmode external -extldflags '-static'" flags doesn't bring down the binary size. The heavy lifting is done by '-s -w'. It is a good idea to drop privileges even if there's a small attack surface. At $work we use the following template. Sharing in case you find it interesting: FROM golang:1.17.1-alpine3.14 as builder RUN apk update && apk add ca-certificates curl git make tzdata RUN adduser -u 5003 --gecos '' --disabled-password --no-create-home mycompany COPY . /app WORKDIR /app RUN make build FROM scratch COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ COPY --from=builder /app/bin/app-3 /bin/app-3 COPY --from=builder /etc/passwd /etc/passwd USER mycompany CMD ["app-3"] And a very simple makefile: help: @echo "Please use 'make <target>' where <target> is one of the following:" @echo " test to run unit tests." @echo " build to build the app as a binary." @echo " build-image to build the app container." @echo " run to run the app with go." run: go run -ldflags="$(govvv -flags -pkg) -w -s" ./cmd/app-3/main.go test: go test -v -coverpkg=./... -coverprofile=profile.cov ./... go tool cover -func profile.cov rm profile.cov build: CGO_ENABLED=0 go build -mod=readonly -a -ldflags="$(govvv -flags -pkg $(go list ./info)) -w -s -linkmode external -extldflags '-static'" -o ./bin/app-3 ./cmd/app-3/* build-image: docker build -t mycompanytown/app-3:latest .