Merge pull request #1621 from ministryofjustice/scratch

Use scratch for image bases

cmd/mock-os-api/main.go

@@ -2,15 +2,14 @@
 package main
 
 import (
+	"cmp"
 	"log"
 	"net/http"
 	"os"
-
-	"github.com/ministryofjustice/opg-go-common/env"
 )
 
 func main() {
-	port := env.Get("PORT", "8080")
+	port := cmp.Or(os.Getenv("PORT"), "8080")
 
 	http.HandleFunc("/search/places/v1/postcode", func(w http.ResponseWriter, r *http.Request) {
 		postcode := r.URL.Query().Get("postcode")

docker/mlpa/Dockerfile

@@ -36,6 +36,9 @@ ARG TAG=v0.0.0
 
 WORKDIR /app
 
+RUN addgroup -S user && \
+  adduser -S -g user user
+
 COPY --link go.mod go.sum ./
 RUN go mod download
 
@@ -44,27 +47,19 @@ COPY --link internal ./internal
 
 RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -ldflags="-X main.Tag=${TAG}" -o /go/bin/mlpab ./cmd/mlpa
 
-FROM alpine:3.20.3 AS production
+FROM scratch AS production
 
 WORKDIR /go/bin
 
-COPY --link web/robots.txt web/robots.txt
 COPY --from=asset-env /app/web/static web/static
+COPY --from=build-env /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=build-env /etc/passwd /etc/passwd
 COPY --from=build-env /go/bin/mlpab mlpab
+COPY --link web/robots.txt web/robots.txt
 COPY --link web/template web/template
 COPY --link lang lang
 
-
-RUN addgroup -S user && \
-  adduser -S -g user user && \
-  chown -R user:user mlpab web/template web/static web/robots.txt
-
-COPY scripts/docker_hardening/alpine_image_hardening.sh /harden.sh
-
-RUN /harden.sh && rm /harden.sh
-
 USER user
-
 EXPOSE 8080
 
 ENTRYPOINT ["./mlpab"]

docker/mock-notify/Dockerfile

@@ -1,20 +1,20 @@
 FROM golang:1.23.3-alpine AS build-env
 
-RUN apk --no-cache add openssl=3.3.2-r1
-
 WORKDIR /app
 
-COPY go.mod go.sum ./
+RUN apk --no-cache add openssl=3.3.2-r1
+
+COPY --link go.mod go.sum ./
 RUN go mod download
 
-COPY cmd/mock-notify ./cmd/mock-notify
+COPY --link cmd/mock-notify ./cmd/mock-notify
+
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -a -installsuffix cgo -o /go/bin/mock-notify ./cmd/mock-notify 
 
-RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -a -installsuffix cgo -o mock-notify ./cmd/mock-notify
+FROM scratch AS production
 
-RUN addgroup --system app && \
-  adduser --system --gecos app app && \
-  chown -R app:app /app
+WORKDIR /go/bin
 
-USER app
+COPY --from=build-env /go/bin/mock-notify mock-notify
 
-CMD [ "/app/mock-notify" ]
+CMD [ "./mock-notify" ]

docker/mock-os-api/Dockerfile

@@ -1,21 +1,21 @@
 FROM golang:1.23.3-alpine AS build-env
 
-RUN apk --no-cache add openssl=3.3.2-r1
-
 WORKDIR /app
 
-COPY go.mod go.sum ./
+RUN apk --no-cache add openssl=3.3.2-r1
+
+COPY --link go.mod go.sum ./
 RUN go mod download
 
-COPY cmd/mock-os-api ./cmd/mock-os-api
-COPY docker/mock-os-api/data ./data
+COPY --link cmd/mock-os-api ./cmd/mock-os-api
+
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -a -installsuffix cgo -o /go/bin/mock-os-api ./cmd/mock-os-api
 
-RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -a -installsuffix cgo -o mock-os-api ./cmd/mock-os-api
+FROM scratch AS production
 
-RUN addgroup --system app && \
-  adduser --system --gecos app app && \
-  chown -R app:app /app
+WORKDIR /go/bin
 
-USER app
+COPY --from=build-env /go/bin/mock-os-api mock-os-api
+COPY --link docker/mock-os-api/data data
 
-CMD [ "/app/mock-os-api" ]
+CMD [ "./mock-os-api" ]