non-root-distroless-consul-template-with-tini-init-system

Dockerfile

FROM golang:1.16-alpine

WORKDIR /consul-template

RUN apk add --no-cache git
ENV CGO_ENABLED=0 \
    GO111MODULE=on \
    GOOS=linux \
    GOARCH=amd64

COPY go.mod go.sum ./

RUN go mod download

COPY ./ ./

RUN go build -o syscall

FROM golang:1.16-alpine

WORKDIR /consul-template

RUN apk add --no-cache git

ENV CGO_ENABLED=0 \
    GO111MODULE=on \
    GOOS=linux \
    GOARCH=amd64

RUN git clone -b v0.25.1 https://github.com/hashicorp/consul-template

RUN cd consul-template && \
        go build -o "ct"

RUN mkdir -p /consul-template/data

FROM gcr.io/distroless/static:nonroot-amd64

WORKDIR /consul-template

COPY --from=1 --chown=nonroot:nonroot /consul-template/consul-template/ct /usr/local/bin/ct
COPY --from=0 --chown=nonroot:nonroot /consul-template/syscall ./
COPY --from=1 --chown=nonroot:nonroot /consul-template/data /consul-template/data

USER nonroot
ENTRYPOINT ["./syscall"]