Multistage build for Golang binaries

Dockerfile

# You should override $PARENT at build-time to name the upper-level container
#     e.g. node:7-alpine
# You may need to override $DOCKER_BASE if you're using this repo as a Submodule of another builder repo
# Override $CONFIG_FILE to use a different config. file

# Note: This will only work for recent versions of Docker
# Note: Your $PARENT base OS/Distribution (Debian or Alpine) must be compatible with the Golang builder base.
#      A Golang binary built with Debian won't usually work on Alpine out-of-the-box, for example

# Debian-based image:
#ARG PARENT_BUILD=golang:1.10
#ARG PARENT=debian

# Centos-based image:
#ARG PARENT_BUILD=golang:1.10
#ARG PARENT=centos

# Alpine-based image:
ARG PARENT_BUILD=golang:1.10-alpine
ARG PARENT=alpine

##########

FROM $PARENT_BUILD as builder

ARG DOCKER_BASE=.

RUN if [ -f /etc/debian_version ]; then \
      apt-get update && apt-get upgrade -y && \
      apt-get install -y git make; \
    \
    elif [ -f /etc/alpine-release ]; then \
      apk upgrade --no-cache --update && \
      apk add --no-cache --update ca-certificates git make; \
    fi

COPY $DOCKER_BASE/ /app

RUN cd /app && make clean test all

##########

FROM $PARENT

RUN if [ -f /etc/debian_version ]; then \
      apt-get update && apt-get upgrade -y && \
      apt-get install -y ca-certificates && \
      addgroup app && \
      adduser --disabled-password --ingroup app --home /app --shell /bin/sh app; \
      \
    elif [ -f /etc/alpine-release ]; then \
      apk upgrade --no-cache --update && \
      apk add --no-cache --update ca-certificates && \
      addgroup app && \
      adduser -D -G app -h /app -s /bin/sh app; \
      \
    elif [ -f /etc/centos-release ]; then \
      yum -y update && yum clean all && \
      yum -y update ca-certificates && yum clean all && \
      groupadd app && \
      adduser -g app -d /app -s /bin/sh app; \
    fi

USER app
WORKDIR /app