11# VNF Operator Multi-stage Dockerfile
2- # Stage 1: Build
3- FROM golang:1.24.7-alpine AS builder
2+ # Stage 1: Build with Go 1.24.7
3+ # Note: Using golang:latest and setting GOTOOLCHAIN to go1.24.7
4+ FROM golang:alpine AS builder
5+
6+ # Force Go 1.24.7 via GOTOOLCHAIN
7+ ENV GOTOOLCHAIN=go1.24.7
8+ ENV GO124TELEMETRY=off
9+ ENV GOPROXY=https://proxy.golang.org,direct
10+ ENV GOSUMDB=sum.golang.org
11+ ENV GOWORK=off
412
513# Security labels and metadata
614LABEL maintainer="O-RAN MANO Team"
@@ -14,17 +22,17 @@ LABEL security.scan="trivy,grype,snyk"
1422LABEL security.distroless="true"
1523LABEL security.user="non-root"
1624
17- # Security: Use non-root user for build
18- RUN adduser -D -s /bin/sh appuser
19-
20- # Install security updates and necessary tools, clean cache
21- RUN apk update && apk upgrade && apk add --no-cache \
25+ # Install necessary tools
26+ RUN apk add --no-cache \
2227 git \
2328 ca-certificates \
2429 tzdata && \
2530 update-ca-certificates && \
2631 rm -rf /var/cache/apk/* /tmp/* /var/tmp/*
2732
33+ # Security: Use non-root user for build
34+ RUN adduser -D -s /bin/sh appuser
35+
2836# Set working directory
2937WORKDIR /workspace
3038
@@ -33,26 +41,21 @@ COPY adapters/vnf-operator/go.mod go.mod
3341COPY adapters/vnf-operator/go.sum go.sum
3442
3543# Copy pkg/security module (needed for transitive dependencies)
36- # The go.mod may have indirect dependencies on pkg/security through other modules
3744COPY pkg/security ../pkg/security
3845
3946# Copy api module for local replace directive
4047COPY adapters/vnf-operator/api /workspace/api
4148
42- # Download dependencies with explicit toolchain
43- ENV GOTOOLCHAIN=go1.24.7
44- ENV GOPROXY=https://proxy.golang.org,direct
45- ENV GOSUMDB=sum.golang.org
46-
47- # Disable workspace mode for Docker build
48- ENV GOWORK=off
49-
49+ # Download dependencies - Go will automatically download go1.24.7 toolchain if needed
5050RUN go mod download || (sleep 2 && go mod download) || (sleep 5 && go mod download)
5151
5252# Copy source code
5353COPY adapters/vnf-operator/ .
5454
55- # Build the binary with security flags
55+ # Run go mod tidy to update dependencies for Go 1.24.7
56+ RUN go mod tidy
57+
58+ # Build the binary with security flags using Go 1.24.7
5659RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
5760 -ldflags='-w -s -extldflags "-static"' \
5861 -a -installsuffix cgo \
@@ -84,9 +87,9 @@ func main() {
8487EOF
8588
8689RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
87- -ldflags='-w -s -extldflags "-static"' \
88- -a -installsuffix cgo \
89- -o healthcheck healthcheck.go
90+ -ldflags='-w -s -extldflags "-static"' \
91+ -a -installsuffix cgo \
92+ -o healthcheck healthcheck.go
9093
9194# Stage 2: Runtime with distroless for maximum security
9295FROM gcr.io/distroless/static:nonroot
@@ -97,7 +100,7 @@ LABEL security.scan="trivy,grype,snyk"
97100LABEL security.user="non-root"
98101LABEL security.distroless="true"
99102LABEL security.base.image="gcr.io/distroless/static:nonroot"
100- LABEL security.go.version="1.23.6 "
103+ LABEL security.go.version="1.24.7 "
101104LABEL security.scan.date="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
102105
103106# Copy the binaries
@@ -111,7 +114,6 @@ USER 65532:65532
111114EXPOSE 8080 8081 9443
112115
113116# Health check - using custom healthcheck binary for distroless compatibility
114- # Checks the /healthz endpoint typically provided by controller-runtime
115117HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
116118 CMD ["/healthcheck" ]
117119
0 commit comments