Skip to content

Commit fee3be1

Browse files
Red-GVrogercoll
Red-GV
and
rogercoll
authored
[checkout/product-catalog]: replace alpine base image with distroless image (open-telemetry#2161)
* [checkout/product-catalog]: bump go to v1.24, pin tools via go.mod, move to distroless images Signed-off-by: Gerard Vanloo <gerard.vanloo@ibm.com> * Remove unneeded GO111MODULE Co-authored-by: Roger Coll <roger.coll@elastic.co> --------- Signed-off-by: Gerard Vanloo <gerard.vanloo@ibm.com> Co-authored-by: Roger Coll <roger.coll@elastic.co>
1 parent 870f33c commit fee3be1

File tree

9 files changed

+51
-78
lines changed

9 files changed

+51
-78
lines changed

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ the release.
1515
([#2162](https://github.com/open-telemetry/opentelemetry-demo/pull/2162))
1616
* [cartservice] Refactor OpenFeature integration and add Dependency Injection support
1717
([#2160](https://github.com/open-telemetry/opentelemetry-demo/pull/2160))
18+
* [checkout]: change image from alpine to distroless to reduce size
19+
([#2161](https://github.com/open-telemetry/opentelemetry-demo/pull/2161))
20+
* [product-catalog]: change image from alpine to distroless to reduce size
21+
([#2161](https://github.com/open-telemetry/opentelemetry-demo/pull/2161))
1822

1923
## 2.0.2
2024

‎src/checkout/Dockerfile‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,27 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44

5-
FROM golang:1.22-alpine AS builder
5+
FROM golang:1.24-bookworm AS builder
66

77
WORKDIR /usr/src/app/
88

9-
RUN --mount=type=cache,target=/go/pkg/mod/ \
10-
--mount=type=bind,source=./src/checkout/go.sum,target=go.sum \
11-
--mount=type=bind,source=./src/checkout/go.mod,target=go.mod \
12-
go mod download
9+
COPY ./src/checkout/go.mod go.mod
10+
COPY ./src/checkout/go.sum go.sum
1311

14-
RUN --mount=type=cache,target=/go/pkg/mod/ \
15-
--mount=type=cache,target=/root/.cache/go-build \
16-
--mount=type=bind,rw,source=./src/checkout,target=. \
17-
go build -ldflags "-s -w" -o /go/bin/checkout/ ./
12+
RUN go mod download
1813

19-
FROM alpine
14+
COPY ./src/checkout/genproto/oteldemo/ genproto/oteldemo/
15+
COPY ./src/checkout/kafka/ kafka/
16+
COPY ./src/checkout/money/ money/
17+
COPY ./src/checkout/main.go main.go
18+
19+
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags "-s -w" -o checkout main.go
20+
21+
FROM gcr.io/distroless/static-debian12:nonroot
2022

2123
WORKDIR /usr/src/app/
2224

23-
COPY --from=builder /go/bin/checkout/ ./
25+
COPY --from=builder /usr/src/app/checkout/ ./
2426

2527
EXPOSE ${CHECKOUT_PORT}
2628
ENTRYPOINT [ "./checkout" ]

‎src/checkout/genproto/Dockerfile‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,13 @@
11
# Copyright The OpenTelemetry Authors
22
# SPDX-License-Identifier: Apache-2.0
33

4-
FROM golang:1.22-alpine
4+
FROM golang:1.24-alpine
55

66
WORKDIR /build
77

88
RUN apk add --no-cache protobuf-dev
99

10-
COPY ./src/checkout/go.mod ./
11-
COPY ./src/checkout/go.sum ./
12-
COPY ./src/checkout/tools.go ./
10+
COPY ./src/checkout/go.mod go.mod
11+
COPY ./src/checkout/go.sum go.sum
1312

14-
RUN go env -w GOMODCACHE=/root/.cache/go-build
15-
RUN --mount=type=cache,target=/root/.cache/go-build \
16-
go list -e -f '{{range .Imports}}{{.}} {{end}}' tools.go | CGO_ENABLED=0 xargs go install -mod=readonly
13+
RUN go install tool

‎src/checkout/go.mod‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
module github.com/open-telemetry/opentelemetry-demo/src/checkout
22

3-
go 1.22.7
4-
5-
toolchain go1.22.9
3+
go 1.24.2
64

75
require (
86
github.com/IBM/sarama v1.45.1
@@ -21,7 +19,6 @@ require (
2119
go.opentelemetry.io/otel/sdk/metric v1.35.0
2220
go.opentelemetry.io/otel/trace v1.35.0
2321
google.golang.org/grpc v1.71.0
24-
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
2522
google.golang.org/protobuf v1.36.5
2623
)
2724

@@ -86,6 +83,7 @@ require (
8683
golang.org/x/text v0.22.0 // indirect
8784
google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a // indirect
8885
google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect
86+
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
8987
gopkg.in/inf.v0 v0.9.1 // indirect
9088
gopkg.in/yaml.v2 v2.4.0 // indirect
9189
gopkg.in/yaml.v3 v3.0.1 // indirect
@@ -96,3 +94,8 @@ require (
9694
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
9795
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
9896
)
97+
98+
tool (
99+
google.golang.org/grpc/cmd/protoc-gen-go-grpc
100+
google.golang.org/protobuf/cmd/protoc-gen-go
101+
)

‎src/checkout/tools.go‎

Lines changed: 0 additions & 17 deletions
This file was deleted.

‎src/product-catalog/Dockerfile‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,26 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44

5-
FROM golang:1.22-alpine AS builder
5+
FROM golang:1.24-bookworm AS builder
66

77
WORKDIR /usr/src/app/
88

9-
RUN --mount=type=cache,target=/go/pkg/mod/ \
10-
--mount=type=bind,source=./src/product-catalog/go.sum,target=go.sum \
11-
--mount=type=bind,source=./src/product-catalog/go.mod,target=go.mod \
12-
go mod download
9+
COPY ./src/product-catalog/go.mod go.mod
10+
COPY ./src/product-catalog/go.sum go.sum
1311

14-
RUN --mount=type=cache,target=/go/pkg/mod/ \
15-
--mount=type=cache,target=/root/.cache/go-build \
16-
--mount=type=bind,rw,source=./src/product-catalog,target=. \
17-
go build -ldflags "-s -w" -o /go/bin/product-catalog/ ./
12+
RUN go mod download
1813

19-
FROM alpine AS release
14+
COPY ./src/product-catalog/genproto/oteldemo/ genproto/oteldemo/
15+
COPY ./src/product-catalog/products/ products/
16+
COPY ./src/product-catalog/main.go main.go
17+
18+
RUN CGO_ENABLED=0 GOOS=linux GO111MODULE=on go build -ldflags "-s -w" -o product-catalog main.go
19+
20+
FROM gcr.io/distroless/static-debian12:nonroot
2021

2122
WORKDIR /usr/src/app/
2223

23-
COPY --from=builder /go/bin/product-catalog/ ./
24+
COPY --from=builder /usr/src/app/product-catalog/ ./
2425

2526
EXPOSE ${PRODUCT_CATALOG_PORT}
2627
ENTRYPOINT [ "./product-catalog" ]

‎src/product-catalog/genproto/Dockerfile‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,13 @@
11
# Copyright The OpenTelemetry Authors
22
# SPDX-License-Identifier: Apache-2.0
33

4-
FROM golang:1.22-alpine
4+
FROM golang:1.24-alpine
55

66
WORKDIR /build
77

88
RUN apk add --no-cache protobuf-dev
99

10-
COPY ./src/product-catalog/go.mod ./
11-
COPY ./src/product-catalog/go.sum ./
12-
COPY ./src/product-catalog/tools.go ./
10+
COPY ./src/product-catalog/go.mod go.mod
11+
COPY ./src/product-catalog/go.sum go.sum
1312

14-
RUN go env -w GOMODCACHE=/root/.cache/go-build
15-
RUN --mount=type=cache,target=/root/.cache/go-build \
16-
go list -e -f '{{range .Imports}}{{.}} {{end}}' tools.go | CGO_ENABLED=0 xargs go install -mod=readonly \
13+
RUN go install tool

‎src/product-catalog/go.mod‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
module github.com/opentelemetry/opentelemetry-demo/src/product-catalog
22

3-
go 1.22.7
4-
5-
toolchain go1.22.9
3+
go 1.24.2
64

75
require (
86
github.com/open-feature/go-sdk v1.14.1
@@ -18,7 +16,6 @@ require (
1816
go.opentelemetry.io/otel/sdk/metric v1.35.0
1917
go.opentelemetry.io/otel/trace v1.35.0
2018
google.golang.org/grpc v1.71.0
21-
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
2219
google.golang.org/protobuf v1.36.5
2320
)
2421

@@ -66,6 +63,7 @@ require (
6663
golang.org/x/text v0.22.0 // indirect
6764
google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a // indirect
6865
google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect
66+
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
6967
gopkg.in/inf.v0 v0.9.1 // indirect
7068
gopkg.in/yaml.v2 v2.4.0 // indirect
7169
gopkg.in/yaml.v3 v3.0.1 // indirect
@@ -76,3 +74,8 @@ require (
7674
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
7775
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
7876
)
77+
78+
tool (
79+
google.golang.org/grpc/cmd/protoc-gen-go-grpc
80+
google.golang.org/protobuf/cmd/protoc-gen-go
81+
)

‎src/product-catalog/tools.go‎

Lines changed: 0 additions & 17 deletions
This file was deleted.

0 commit comments

Comments
 (0)