Skip to content

[checkout/product-catalog]: replace alpine base image with distroless image #2161

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
julianocosta89 merged 3 commits into from
May 12, 2025
Merged

[checkout/product-catalog]: replace alpine base image with distroless image #2161

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a3d8219
[checkout/product-catalog]: bump go to v1.24, pin tools via go.mod, m…
Red-GV Apr 29, 2025
884673b
Remove unneeded GO111MODULE
Red-GV May 5, 2025
08479f3
Merge branch 'main' into checkout-tool-pin
Red-GV May 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,10 @@ the release.
([#2162](https://github.com/open-telemetry/opentelemetry-demo/pull/2162))
* [cartservice] Refactor OpenFeature integration and add Dependency Injection support
([#2160](https://github.com/open-telemetry/opentelemetry-demo/pull/2160))
* [checkout]: change image from alpine to distroless to reduce size
([#2161](https://github.com/open-telemetry/opentelemetry-demo/pull/2161))
* [product-catalog]: change image from alpine to distroless to reduce size
([#2161](https://github.com/open-telemetry/opentelemetry-demo/pull/2161))

## 2.0.2

Expand Down
24 changes: 13 additions & 11 deletions src/checkout/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,25 +2,27 @@
# SPDX-License-Identifier: Apache-2.0


FROM golang:1.22-alpine AS builder
FROM golang:1.24-bookworm AS builder

WORKDIR /usr/src/app/

RUN --mount=type=cache,target=/go/pkg/mod/ \
--mount=type=bind,source=./src/checkout/go.sum,target=go.sum \
--mount=type=bind,source=./src/checkout/go.mod,target=go.mod \
go mod download
COPY ./src/checkout/go.mod go.mod
COPY ./src/checkout/go.sum go.sum

RUN --mount=type=cache,target=/go/pkg/mod/ \
--mount=type=cache,target=/root/.cache/go-build \
--mount=type=bind,rw,source=./src/checkout,target=. \
go build -ldflags "-s -w" -o /go/bin/checkout/ ./
RUN go mod download

FROM alpine
COPY ./src/checkout/genproto/oteldemo/ genproto/oteldemo/
COPY ./src/checkout/kafka/ kafka/
COPY ./src/checkout/money/ money/
COPY ./src/checkout/main.go main.go

RUN CGO_ENABLED=0 GOOS=linux go build -ldflags "-s -w" -o checkout main.go

FROM gcr.io/distroless/static-debian12:nonroot

WORKDIR /usr/src/app/

COPY --from=builder /go/bin/checkout/ ./
COPY --from=builder /usr/src/app/checkout/ ./

EXPOSE ${CHECKOUT_PORT}
ENTRYPOINT [ "./checkout" ]
11 changes: 4 additions & 7 deletions src/checkout/genproto/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,13 @@
# Copyright The OpenTelemetry Authors
# SPDX-License-Identifier: Apache-2.0

FROM golang:1.22-alpine
FROM golang:1.24-alpine

WORKDIR /build

RUN apk add --no-cache protobuf-dev

COPY ./src/checkout/go.mod ./
COPY ./src/checkout/go.sum ./
COPY ./src/checkout/tools.go ./
COPY ./src/checkout/go.mod go.mod
COPY ./src/checkout/go.sum go.sum

RUN go env -w GOMODCACHE=/root/.cache/go-build
RUN --mount=type=cache,target=/root/.cache/go-build \
go list -e -f '{{range .Imports}}{{.}} {{end}}' tools.go | CGO_ENABLED=0 xargs go install -mod=readonly
RUN go install tool
11 changes: 7 additions & 4 deletions src/checkout/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
module github.com/open-telemetry/opentelemetry-demo/src/checkout

go 1.22.7

toolchain go1.22.9
go 1.24.2

require (
github.com/IBM/sarama v1.45.1
Expand All @@ -21,7 +19,6 @@ require (
go.opentelemetry.io/otel/sdk/metric v1.35.0
go.opentelemetry.io/otel/trace v1.35.0
google.golang.org/grpc v1.71.0
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
google.golang.org/protobuf v1.36.5
)

Expand Down Expand Up @@ -86,6 +83,7 @@ require (
golang.org/x/text v0.22.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
Expand All @@ -96,3 +94,8 @@ require (
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
)

tool (
google.golang.org/grpc/cmd/protoc-gen-go-grpc
google.golang.org/protobuf/cmd/protoc-gen-go
)
17 changes: 0 additions & 17 deletions src/checkout/tools.go
View file
Open in desktop

This file was deleted.

23 changes: 12 additions & 11 deletions src/product-catalog/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,25 +2,26 @@
# SPDX-License-Identifier: Apache-2.0


FROM golang:1.22-alpine AS builder
FROM golang:1.24-bookworm AS builder

WORKDIR /usr/src/app/

RUN --mount=type=cache,target=/go/pkg/mod/ \
--mount=type=bind,source=./src/product-catalog/go.sum,target=go.sum \
--mount=type=bind,source=./src/product-catalog/go.mod,target=go.mod \
go mod download
COPY ./src/product-catalog/go.mod go.mod
COPY ./src/product-catalog/go.sum go.sum

RUN --mount=type=cache,target=/go/pkg/mod/ \
--mount=type=cache,target=/root/.cache/go-build \
--mount=type=bind,rw,source=./src/product-catalog,target=. \
go build -ldflags "-s -w" -o /go/bin/product-catalog/ ./
RUN go mod download

FROM alpine AS release
COPY ./src/product-catalog/genproto/oteldemo/ genproto/oteldemo/
COPY ./src/product-catalog/products/ products/
COPY ./src/product-catalog/main.go main.go

RUN CGO_ENABLED=0 GOOS=linux GO111MODULE=on go build -ldflags "-s -w" -o product-catalog main.go

FROM gcr.io/distroless/static-debian12:nonroot

WORKDIR /usr/src/app/

COPY --from=builder /go/bin/product-catalog/ ./
COPY --from=builder /usr/src/app/product-catalog/ ./

EXPOSE ${PRODUCT_CATALOG_PORT}
ENTRYPOINT [ "./product-catalog" ]
11 changes: 4 additions & 7 deletions src/product-catalog/genproto/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,13 @@
# Copyright The OpenTelemetry Authors
# SPDX-License-Identifier: Apache-2.0

FROM golang:1.22-alpine
FROM golang:1.24-alpine

WORKDIR /build

RUN apk add --no-cache protobuf-dev

COPY ./src/product-catalog/go.mod ./
COPY ./src/product-catalog/go.sum ./
COPY ./src/product-catalog/tools.go ./
COPY ./src/product-catalog/go.mod go.mod
COPY ./src/product-catalog/go.sum go.sum

RUN go env -w GOMODCACHE=/root/.cache/go-build
RUN --mount=type=cache,target=/root/.cache/go-build \
go list -e -f '{{range .Imports}}{{.}} {{end}}' tools.go | CGO_ENABLED=0 xargs go install -mod=readonly \
RUN go install tool
11 changes: 7 additions & 4 deletions src/product-catalog/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
module github.com/opentelemetry/opentelemetry-demo/src/product-catalog

go 1.22.7

toolchain go1.22.9
go 1.24.2

require (
github.com/open-feature/go-sdk v1.14.1
Expand All @@ -18,7 +16,6 @@ require (
go.opentelemetry.io/otel/sdk/metric v1.35.0
go.opentelemetry.io/otel/trace v1.35.0
google.golang.org/grpc v1.71.0
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
google.golang.org/protobuf v1.36.5
)

Expand Down Expand Up @@ -66,6 +63,7 @@ require (
golang.org/x/text v0.22.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
Expand All @@ -76,3 +74,8 @@ require (
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
)

tool (
google.golang.org/grpc/cmd/protoc-gen-go-grpc
google.golang.org/protobuf/cmd/protoc-gen-go
)
17 changes: 0 additions & 17 deletions src/product-catalog/tools.go
View file
Open in desktop

This file was deleted.