Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions Dockerfile
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
# syntax=docker/dockerfile:1.7

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Using a specific minor version like 1.7 for the Dockerfile syntax directive prevents the build from automatically receiving security updates, bug fixes, and performance improvements. It is highly recommended to use # syntax=docker/dockerfile:1 to pin to the major version 1, which automatically resolves to the latest stable minor release while maintaining backward compatibility.

# syntax=docker/dockerfile:1

# Use the official golang image to create a binary.
# This is based on Debian and sets the GOPATH to /go.
# https://hub.docker.com/_/golang
Expand All @@ -8,7 +9,8 @@ WORKDIR /app

# Cache deps
COPY go.mod go.sum ./
RUN go mod download
RUN --mount=type=cache,target=/go/pkg/mod \
go mod download
Comment on lines +12 to +13

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

When using --mount=type=cache without a unique id, the cache is shared globally across all builds on the same runner that use the same target path. In a shared CI/CD environment with multiple Go projects, this can lead to cache thrashing and frequent evictions. Specifying a unique id (e.g., id=mpa-service-go-mod) ensures that this project's module cache is isolated and preserved.

RUN --mount=type=cache,id=mpa-service-go-mod,target=/go/pkg/mod \
    go mod download


# Copy source
COPY . .
Expand All @@ -18,7 +20,9 @@ ARG TARGETOS
ARG TARGETARCH

# Build static binary for correct platform
RUN CGO_ENABLED=0 \
RUN --mount=type=cache,target=/go/pkg/mod \
--mount=type=cache,target=/root/.cache/go-build \
CGO_ENABLED=0 \
Comment on lines +23 to +25

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

To ensure cache isolation and prevent cache thrashing in shared CI/CD environments, specify unique ids for both the Go module cache and the Go build cache mounts. This ensures that the caches are dedicated to this project and not overwritten or evicted by other Go builds on the same runner.

RUN --mount=type=cache,id=mpa-service-go-mod,target=/go/pkg/mod \
    --mount=type=cache,id=mpa-service-go-build,target=/root/.cache/go-build \
    CGO_ENABLED=0 \

GOOS=$TARGETOS \
GOARCH=$TARGETARCH \
go build \
Expand Down
Loading