build: cross-compile the multi-arch image instead of emulating it

.github/workflows/actions.lock

@@ -12,7 +12,6 @@ workflows:
         - 'docker/build-push-action@v7.4.0'
         - 'docker/login-action@v4.6.0'
         - 'docker/setup-buildx-action@v4.4.1'
-        - 'docker/setup-qemu-action@v4.4.0'
     '.github/workflows/test-chart.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/setup-go@v7.0.0'
@@ -53,8 +52,3 @@ dependencies:
         commit: 'sha1-f87e5991a6d7451dcb8d9637bfbc97413f497069'
         owner_id: 5429470
         repo_id: 288485773
-    'docker/setup-qemu-action@v4.4.0':
-        ref: 'v4.4.0'
-        commit: 'sha1-99012661954931238ded8c8b007157a8430204e1'
-        owner_id: 5429470
-        repo_id: 288487894

.github/workflows/release.yml

@@ -80,9 +80,6 @@ jobs:
             echo "charts=oci://ghcr.io/$owner/charts"
           } >>"$GITHUB_OUTPUT"
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.4.0
-
       - name: Set up Buildx
         uses: docker/setup-buildx-action@v4.4.1
 

Dockerfile

@@ -5,13 +5,14 @@
 # those registries are unreachable.
 ARG GO_IMAGE=golang:1.26
 ARG RUNTIME_IMAGE=gcr.io/distroless/static:nonroot
-FROM ${GO_IMAGE} AS builder
+# Multi-arch: Go cross-compiles, so the build stage runs on the builder's own
+# platform and only the runtime stage is per-target -- no emulation needed.
+FROM --platform=$BUILDPLATFORM ${GO_IMAGE} AS builder
 # TARGETOS/TARGETARCH are filled in by BuildKit. The classic builder does not
 # set them, and an unset one aborts the RUN below under `set -u` -- hence the
 # `:-` defaults there. An empty GOARCH is the intended fallback, not a bug: go
 # then builds for the host, which is what a non-buildx build wants anyway.
-ARG TARGETOS
-ARG TARGETARCH
+ARG TARGETOS TARGETARCH
 # Module proxy. The default is the public one; pass a mirror where
 # proxy.golang.org is unreachable. GOSUMDB is off so a build that cannot reach
 # sum.golang.org still works (go.sum is committed), and GOTOOLCHAIN=local keeps
@@ -30,18 +31,16 @@ WORKDIR /workspace
 COPY . .
 
 # Build
-# the GOARCH has no default value to allow the binary to be built according to the host where the command
-# was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
-# the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
-# by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
+# GOOS/GOARCH come from the target platform, so the binary matches the runtime
+# stage even though this stage runs natively on the build platform.
 RUN set -eu; \
     mod="${GO_MOD_MODE}"; \
     if [ "${mod}" = "auto" ]; then \
         if [ -f vendor/modules.txt ]; then mod=vendor; else mod=mod; fi; \
     fi; \
     echo "building with -mod=${mod}"; \
     if [ "${mod}" != "vendor" ]; then go mod download; fi; \
-    CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH:-} \
+    CGO_ENABLED=0 GOOS="${TARGETOS:-linux}" GOARCH="${TARGETARCH:-}" \
         go build -mod="${mod}" -a -o manager cmd/main.go
 
 # Use distroless as minimal base image to package the manager binary

Makefile

@@ -153,13 +153,10 @@ docker-push: ## Push docker image with the manager.
 PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
 .PHONY: docker-buildx
 docker-buildx: ## Build and push docker image for the manager for cross-platform support
-	# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile
-	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
 	- $(CONTAINER_TOOL) buildx create --name llmscaleoperator-builder
 	$(CONTAINER_TOOL) buildx use llmscaleoperator-builder
-	- $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) --tag ${IMG} -f Dockerfile.cross .
+	- $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) --tag ${IMG} .
 	- $(CONTAINER_TOOL) buildx rm llmscaleoperator-builder
-	rm Dockerfile.cross
 
 .PHONY: build-installer
 build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment.