Use multi-stage builds to create the image

template/dockerfile.go

@@ -19,26 +19,35 @@ USER ${USER_ID}:${GROUP_ID}
 WORKDIR /app
 `
 
-const Dockerfile = `FROM alpine:{{.AlpineVersion}} as base
+const Dockerfile = `FROM golang:{{.GoVersion}}-stretch as builder
 
-RUN apk --no-cache update && \
-    apk --no-cache add ca-certificates tzdata && \
-    rm -rf /var/cache/apk/*
+RUN apt-get update && \
+    apt-get dist-upgrade -y && \
+    apt-get install -y --no-install-recommends ca-certificates tzdata && \
+	update-ca-certificates
 
-RUN adduser -D -g '' appuser
+RUN adduser --disabled-password --gecos '' appuser
 
-COPY ./cmd/{{.Project}}/{{.Project}} /app/{{.Project}}
+WORKDIR $GOPATH/src/{{.Module}}
+
+COPY . .
+
+RUN go mod download
+
+ARG VERSION
+
+RUN GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="-w -s -X main.Version=${VERSION}" -o /go/bin/{{.Project}} ./cmd/{{.Project}}
 
 FROM scratch
 
-COPY --from=base /usr/share/zoneinfo /usr/share/zoneinfo
-COPY --from=base /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
-COPY --from=base /etc/passwd /etc/passwd
-COPY --from=base /etc/group /etc/group
-COPY --from=base /app/{{.Project}} /app/{{.Project}}
+COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=builder /etc/passwd /etc/passwd
+COPY --from=builder /etc/group /etc/group
+COPY --from=builder /go/bin/{{.Project}} /bin/{{.Project}}
 
 # Use an unprivileged user.
 USER appuser
 
-ENTRYPOINT ["/app/{{.Project}}"]
+ENTRYPOINT ["/bin/{{.Project}}"]
 `

template/makefile.go

@@ -28,8 +28,8 @@ guard-%:
 modcache:
 	@mkdir -p $(modcachedir)
 
-image: build
-	docker build . -t $(img)
+image:
+	docker build . -t $(img) --build-arg VERSION=$(version)
 
 imagedev:
 	docker build . -t $(imgdev) -f ./hack/Dockerfile $(dockerbuilduser)