dockerfile optimizations

Author: lilydoar

.dockerignore

@@ -1,5 +1,38 @@
-# More info: https://docs.docker.com/engine/reference/builder/#dockerignore-file
-# Ignore build and test binaries.
+# Version control
+.git
+.gitignore
+
+# Documentation
+*.md
+docs/
+
+# Tests
+*_test.go
+internal/testhelpers
+internal/tests
+
+# Development
+.env
+.env.*
+*.log
+skaffold.yaml
+skaffold.example.env
+
+# Build artifacts
 bin/
 helm/
 internal/demo
+
+# IDE
+.vscode
+.idea
+*.swp
+
+# CI/CD
+.github
+.goreleaser.yml
+.goreleaser.main.yml
+
+# Go
+go.work
+go.work.sum

Dockerfile

@@ -1,17 +1,12 @@
-# Build the manager binary
 FROM golang:1.25 AS builder
 ARG TARGETOS
 ARG TARGETARCH
 
 WORKDIR /workspace
-# Copy the Go Modules manifests
-COPY go.mod go.mod
-COPY go.sum go.sum
-# cache deps before building and copying source so that we don't need to re-download as much
-# and so that source changes don't invalidate our downloaded layer
-RUN go mod download
 
-# Copy the go source
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+
 COPY cmd/main.go cmd/main.go
 COPY api/ api/
 COPY internal/k8s internal/k8s
@@ -20,7 +15,6 @@ COPY internal/controller internal/controller
 COPY internal/planner internal/planner
 COPY internal/defaults internal/defaults
 
-# Build
 # the GOARCH has not a default value to allow the binary be built according to the host where the command
 # was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
 # the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,

Dockerfile.goreleaser

@@ -1,5 +1,9 @@
 FROM gcr.io/distroless/static-debian12:nonroot
 
-COPY temporal-worker-controller /usr/local/bin/temporal-worker-controller
+WORKDIR /app
+
+COPY --chown=nonroot:nonroot temporal-worker-controller /usr/local/bin/temporal-worker-controller
+
+USER nonroot
 
 ENTRYPOINT ["temporal-worker-controller"]