[feature] better build, stripping and distroless filesystem

Author: 11notes

arch.dockerfile

@@ -1,22 +1,47 @@
-# :: Distroless
-  FROM alpine AS fs
-  USER root
-  RUN set -ex; \
-    mkdir -p /rootfs/run/proxy; \
-    mkdir -p /rootfs/etc; \
-    echo "root:x:0:0:root:/root:/bin/sh" > /rootfs/etc/passwd; \
-    echo "root:x:0:root" > /rootfs/etc/group;
+# :: Util
+  FROM 11notes/util AS util
 
-# :: Build // socket-proxy
-  FROM golang:1.24-alpine AS socket-proxy
+# :: Build / socket-proxy
+  FROM golang:1.24-alpine AS build
   ARG TARGETARCH
   ENV CGO_ENABLED=0
+  ENV BUILD_DIR=/go/socket-proxy
+  ENV BUILD_BIN=${BUILD_DIR}/socket-proxy
+
   USER root
+  COPY --from=util /usr/local/bin/ /usr/local/bin
   COPY ./go/ /go
+
+  RUN set -ex; \
+    apk --update --no-cache add \
+      build-base \
+      upx;
+
   RUN set -ex; \
-    cd /go/socket-proxy; \
-    go build -ldflags="-extldflags=-static" -o socket-proxy main.go; \
-    mv socket-proxy /usr/local/bin/socket-proxy;
+    cd ${BUILD_DIR}; \
+    mkdir -p /distroless/usr/local/bin; \
+    go build -ldflags="-extldflags=-static" -o ${BUILD_BIN} main.go; \
+    eleven strip ${BUILD_BIN}; \
+    cp ${BUILD_BIN} /distroless/usr/local/bin;
+
+# :: Distroless / socket-proxy
+  FROM scratch AS distroless-socket-proxy
+  COPY --from=build /distroless/ /
+
+# :: Build / file system
+  FROM alpine AS fs
+  ARG APP_ROOT
+  USER root
+
+  RUN set -ex; \
+    mkdir -p ${APP_ROOT}/etc;
+
+  COPY ./rootfs /
+
+# :: Distroless / file system
+  FROM scratch AS distroless-fs
+  ARG APP_ROOT
+  COPY --from=fs ${APP_ROOT} /${APP_ROOT}
 
 # :: Header
   FROM 11notes/distroless AS distroless
@@ -43,11 +68,11 @@
     ENV SOCKET_PROXY_GID=1000
 
   # :: multi-stage
-    COPY --from=distroless / /
-    COPY --from=socket-proxy /usr/local/bin/socket-proxy /
+    COPY --from=distroless-fs / /
+    COPY --from=distroless-socket-proxy / /
 
 # :: Monitor
-  HEALTHCHECK --interval=5s --timeout=2s CMD ["/socket-proxy", "--healthcheck"]
+  HEALTHCHECK --interval=5s --timeout=2s CMD ["socket-proxy", "--healthcheck"]
 
 # :: Start
-  ENTRYPOINT ["/socket-proxy"]
+  ENTRYPOINT ["socket-proxy"]