refact: Dockerfile is now a multistage scratch build

[wilmardo]

This moves the Go binary in a Docker scratch container for minimal footprint and better security (no shell available and running as non-root).

See this article for the rationale behind these changes:
https://weberc2.bitbucket.io/posts/golang-docker-scratch-app.html

Also adds a .dockerignore that excludes all the files except the ones used within the Dockerfile. Running docker build after make release sends 198.2MB to the Docker daemon, this is now reduced to 13.4MB.
On my system it was a noticeable speed improvement of 42 seconds :)

docker build . -t test --no-cache  0.06s user 0.14s system 2% cpu 9.741 total
docker build . -t test --no-cache  0.48s user 1.92s system 12% cpu 18.871 total

[wilmardo]

If I have some time left someday I might take a stab at releasing multi-arch(amd64/arm64) images with Drone. Are you open for a change like this?
I will use a similar setup as this:
https://github.com/LANsible/docker-mosquitto/blob/master/.drone.yml

[metalmatze]

Hey thanks for the contribution. The Go binary is actually compiled outside of Docker and then only copied into the Docker image. Thus the image size should be alpine + static binary.
As Drone, the CI, is compiling and building that image and I will never push a image from a local machine, I don't think we really need the multi stage image. 😕

[wilmardo]

Hey thanks for the contribution. The Go binary is actually compiled outside of Docker and then only copied into the Docker image. Thus the image size should be alpine + static binary.

True but now it is nothing but the Go binary, no Alpine (FROM scratch is a container with nothing). Saves 5MB in the image size (just a tad) but the most important thing is that there is no shell or tools available. Nobody can use the container to break into the cluster whatsoever.

As Drone, the CI, is compiling and building that image and I will never push a image from a local machine, I don't think we really need the multi stage image. confused

The question above is referring to building/releasing Docker images for amd64 and arm64 from within DroneCI. It is meant as a seperate question for a future PR, not related to this change, sorry for the confusion :)

[metalmatze]

I actually often go into containers to debug things...
I'll go ahead with #67 for now.