Updated Dockerfile in preparation for public Docker image by maciejdudko · Pull Request #826 · temporalio/cli

maciejdudko · 2025-07-09T22:45:14Z

What was changed

Updated Dockerfile to be based on Alpine and to package binaries produced by Goreleaser. Added instructions to CONTRIBUTORS.md on how to build Docker image.

Note that this PR does NOT contain any automation for Docker image publishing. Release 1.4.0 will be published manually after this PR is merged.

Why?

Feature request: #316

Checklist

How was this tested:

goreleaser build --snapshot --clean
docker build --tag temporalio/temporal:snapshot --platform=linux/amd64,linux/arm64 .

Any docs updates needed?
Internal release instructions will need to be updated.

CLAassistant · 2025-07-09T22:45:21Z

All committers have signed the CLA.

bergundy · 2025-07-09T23:17:01Z

Dockerfile

-RUN set -x && apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
-    ca-certificates && \
-    rm -rf /var/lib/apt/lists/*


Can you confirm that this container has the alpine equivalent of ca-certificates?

ca-certificates exists in Alpine repo but is missing in the image. I will push a new revision that has this fixed.

bergundy · 2025-07-09T23:20:09Z

Dockerfile

+FROM --platform=$BUILDARCH scratch AS dist
+COPY ./dist/nix_linux_amd64_v1/temporal /dist/amd64/temporal
+COPY ./dist/nix_linux_arm64/temporal /dist/arm64/temporal

-WORKDIR /app
+FROM alpine:3.22
+ARG TARGETARCH
+COPY --from=dist /dist/$TARGETARCH/temporal /usr/local/bin/temporal


Can't we do this in one step? Why do we need a separate diststep?

The dist step acts as a manual per-architecture mapping to the right binary. Docker doesn't support conditional COPY so due to the differences in Go and Docker target naming, it would be complicated to do in a single step.

Not sure I follow, can't this step be COPY ./dist/$TARGETARCH/temporal /usr/local/bin/temporal?

It won't work because the directory name is in the wrong format (arch is amd64_v1 in Goreleaser but amd64 in Docker).

So use a build arg to say where to copy from instead?

It wouldn't work for building multiplatform image with a single docker build command as all platforms would receive the same argument. I guess we could have a Docker bake file or a shell script wrapper or something but I think we should wait with that kind of stuff until we have proper release automation so that we don't do any throwaway work, and keep this PR as simple as possible. Especially since the extra step doesn't affect the final container image.

bergundy · 2025-07-09T23:23:32Z

Dockerfile

+COPY ./dist/nix_linux_arm64/temporal /dist/arm64/temporal

-WORKDIR /app
+FROM alpine:3.22


Doesn't this also need a --platform flag?

No. --platform defaults to $TARGETPLATFORM, which is what we want here. dist uses $BUILDPLATFORM so it can be potentially cached for multiplatform builds.

cretz · 2025-07-10T12:49:36Z

Dockerfile

+COPY ./dist/nix_linux_arm64/temporal /dist/arm64/temporal

-WORKDIR /app
+FROM alpine:3.22


So we don't test against this OS very well FWIW, though Go is self-contained and doesn't use libc/musl so it should be fine. But just curious why alpine instead of e.g. debian:bookworm-slim or maybe even gcr.io/distroless/static-debian12 or others often seen in the wild? It seems the latter (https://github.com/GoogleContainerTools/distroless) is quite common for this use case.

I was basing the image on our admin-tools image which uses Alpine. I'm not very well versed in Docker conventions, but it works, and Alpine is only 4MB compared to debian:bookworm-slim's 28MB. But I don't have a strong opinion here.

👍 Curious about the distroless one since it's fairly common these days (e.g. it's what Docker uses in their guide sample at https://docs.docker.com/guides/golang/build-images/#multi-stage-builds). But Alpine is fine too. Not a blocker.

I was thinking of recommending distroless too here. Alpine is a bit nicer if you ever want a shell to inspect the image, we may want that if we add support for config files later. Agree it's not a blocker.

cretz · 2025-07-10T12:49:47Z

CONTRIBUTING.md

+Docker image build requires [Goreleaser](https://goreleaser.com/) to build the binaries first, although it doesn't use
+Goreleaser for the Docker image itself.


although it doesn't use Goreleaser for the Docker image itself.

So was looking at https://goreleaser.com/customization/docker/ and it seems they won't publish for you, is that correct? If so, it makes sense we don't want to rely on it.

It's not documented but it can in fact push to Dockerhub. But since it's undocumented I don't want to rely on it. The bigger reason is that it can't build a true multiplatform image, it needs to build them separately for each platform and then combine them with a manifest, and it can only do one tag at a time it seems (and we need two - the version and the latest). It too is very poorly documented, and also we're using Goreleaser v1 which they don't publish docs for anymore (I had to use Web Archive). Overall, it feels very not worth it.

Wondering why, with this conversation seemingly open-ended, the MR was merged.

cretz · 2025-07-10T14:54:48Z

Dockerfile

+COPY ./dist/nix_linux_arm64/temporal /dist/arm64/temporal

-WORKDIR /app
+FROM alpine:3.22


👍 Curious about the distroless one since it's fairly common these days (e.g. it's what Docker uses in their guide sample at https://docs.docker.com/guides/golang/build-images/#multi-stage-builds). But Alpine is fine too. Not a blocker.

maciejdudko requested review from a team as code owners July 9, 2025 22:45

Updated Dockerfile in preparation for public Docker image

ce05c0e

maciejdudko force-pushed the docker-for-publishing branch from 9cc8491 to ce05c0e Compare July 9, 2025 22:48

bergundy reviewed Jul 9, 2025

View reviewed changes

cretz reviewed Jul 10, 2025

View reviewed changes

cretz approved these changes Jul 10, 2025

View reviewed changes

Added ca-certificates and created user account in Dockerfile

9d825b2

bergundy approved these changes Jul 10, 2025

View reviewed changes

maciejdudko merged commit 078aaa7 into temporalio:main Jul 10, 2025
8 checks passed

maciejdudko deleted the docker-for-publishing branch July 10, 2025 18:40

BrewTestBot mentioned this pull request Jul 14, 2025

temporal 1.4.1 Homebrew/homebrew-core#230011

Merged

		Docker image build requires [Goreleaser](https://goreleaser.com/) to build the binaries first, although it doesn't use
		Goreleaser for the Docker image itself.

Conversation

maciejdudko commented Jul 9, 2025

What was changed

Why?

Checklist

Uh oh!

CLAassistant commented Jul 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

CLAassistant commented Jul 9, 2025 •

edited

Loading