Skip to content

Updated Dockerfile in preparation for public Docker image #826

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maciejdudko merged 2 commits into from
Jul 10, 2025
Merged

Updated Dockerfile in preparation for public Docker image #826

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ce05c0e
Updated Dockerfile in preparation for public Docker image
maciejdudko Jul 9, 2025
9d825b2
Added ca-certificates and created user account in Dockerfile
maciejdudko Jul 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,9 @@
/temporal
/temporal.exe

# Goreleaser output
/dist

# Used by IDE
/.idea
/.vscode
Expand Down
15 changes: 15 additions & 0 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,3 +46,18 @@ Note that inclusion of space characters in the value supplied via `-ldflags` is
Here's an example that adds branch info from a local repo to the version string, and includes a space character:

go build -ldflags "-X 'github.com/temporalio/cli/temporalcli.buildInfo=ServerBranch $(git -C ../temporal rev-parse --abbrev-ref HEAD)'" -o temporal ./cmd/temporal/main.go

## Building Docker image

Docker image build requires [Goreleaser](https://goreleaser.com/) to build the binaries first, although it doesn't use
Goreleaser for the Docker image itself.
Comment on lines +52 to +53
Copy link
Contributor

@cretz cretz Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

although it doesn't use Goreleaser for the Docker image itself.

So was looking at https://goreleaser.com/customization/docker/ and it seems they won't publish for you, is that correct? If so, it makes sense we don't want to rely on it.

Copy link
Contributor Author

@maciejdudko maciejdudko Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not documented but it can in fact push to Dockerhub. But since it's undocumented I don't want to rely on it. The bigger reason is that it can't build a true multiplatform image, it needs to build them separately for each platform and then combine them with a manifest, and it can only do one tag at a time it seems (and we need two - the version and the latest). It too is very poorly documented, and also we're using Goreleaser v1 which they don't publish docs for anymore (I had to use Web Archive). Overall, it feels very not worth it.

Copy link

@robross0606 robross0606 Jul 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wondering why, with this conversation seemingly open-ended, the MR was merged.


First, run the Goreleaser build:

goreleaser build --snapshot --clean

Then, run the Docker build using the following command:

docker build --tag temporalio/temporal:snapshot --platform=<platform> .

Currently only `linux/amd64` and `linux/arm64` platforms are supported.
33 changes: 12 additions & 21 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,21 +1,12 @@
FROM golang:1.24-bookworm AS builder

WORKDIR /app

# Copy everything
COPY . ./

# Build
RUN go build ./cmd/temporal

# Use slim container for running
FROM debian:bookworm-slim
RUN set -x && apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
ca-certificates && \
rm -rf /var/lib/apt/lists/*
Comment on lines -13 to -15
Copy link
Member

@bergundy bergundy Jul 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you confirm that this container has the alpine equivalent of ca-certificates?

Copy link
Contributor Author

@maciejdudko maciejdudko Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ca-certificates exists in Alpine repo but is missing in the image. I will push a new revision that has this fixed.

Copy link
Member

@bergundy bergundy Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks.


# Copy binary
COPY --from=builder /app/temporal /app/temporal

# Set CLI as primary entrypoint
ENTRYPOINT ["/app/temporal"]
FROM --platform=$BUILDARCH scratch AS dist
COPY ./dist/nix_linux_amd64_v1/temporal /dist/amd64/temporal
COPY ./dist/nix_linux_arm64/temporal /dist/arm64/temporal

FROM alpine:3.22
Copy link
Member

@bergundy bergundy Jul 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn't this also need a --platform flag?

Copy link
Contributor Author

@maciejdudko maciejdudko Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No. --platform defaults to $TARGETPLATFORM, which is what we want here. dist uses $BUILDPLATFORM so it can be potentially cached for multiplatform builds.

Copy link
Member

@bergundy bergundy Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see.

Copy link
Contributor

@cretz cretz Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So we don't test against this OS very well FWIW, though Go is self-contained and doesn't use libc/musl so it should be fine. But just curious why alpine instead of e.g. debian:bookworm-slim or maybe even gcr.io/distroless/static-debian12 or others often seen in the wild? It seems the latter (https://github.com/GoogleContainerTools/distroless) is quite common for this use case.

Copy link
Contributor Author

@maciejdudko maciejdudko Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was basing the image on our admin-tools image which uses Alpine. I'm not very well versed in Docker conventions, but it works, and Alpine is only 4MB compared to debian:bookworm-slim's 28MB. But I don't have a strong opinion here.

Copy link
Contributor

@cretz cretz Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 Curious about the distroless one since it's fairly common these days (e.g. it's what Docker uses in their guide sample at https://docs.docker.com/guides/golang/build-images/#multi-stage-builds). But Alpine is fine too. Not a blocker.

Copy link
Member

@bergundy bergundy Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was thinking of recommending distroless too here. Alpine is a bit nicer if you ever want a shell to inspect the image, we may want that if we add support for config files later. Agree it's not a blocker.

ARG TARGETARCH
RUN apk add --no-cache ca-certificates
COPY --from=dist /dist/$TARGETARCH/temporal /usr/local/bin/temporal
RUN adduser -u 1000 -D temporal
USER temporal

ENTRYPOINT ["temporal"]