bellsoft/hardened-go repository overview

⁠Hardened Containers images with Go

Hardened Containers images for building Go applications.

It's recommended to use these images as the 'builder' image in multi-stage builds, and use a bellsoft/hardened-base image as a runtime for the application.

For example, if the current directory contains a Go application source code, the following Dockerfile will build it with the Go image and produce a Hardened Containers image with the application:

FROM bellsoft/hardened-go:glibc AS builder

COPY . /app
RUN cd /app && go build -o app .

FROM bellsoft/hardened-base:glibc
COPY --from=builder /app/app /usr/local/bin/
ENTRYPOINT ["/usr/local/bin/app"]

Unless your application strictly depends on Glibc features, please consider using Musl-based builder and runtime images, as it may lead to a smaller final image size.

Images come with the GODEBUG environment variable set to tarinsecurepath=0,zipinsecurepath=0 (see Go 1.20 Release Notes⁠). This can be overridden by setting GODEBUG explicitly.

⁠Tags

• 1.X-glibc, 1.X.Y-glibc - specified version of Go with Glibc
• 1.X-musl, 1.X.Y-musl - specified version of Go with Musl
• glibc - latest Go version with Glibc
• musl, latest - latest Go version with Musl

⁠License

As with all Docker images, these also contain other software, which may be distributed under other licenses.

The list of installed software components and their licenses can be retrieved by executing the grep -E '^[PVL]:' /var/lib/apk/db/installed command.

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.