ideaplexus/go repository overview

⁠Go container

A container with go and ansible.

Every image from go:1.11 to go:1.27 shares the same base (alpine:3.24) and the same tooling (ansible, git, make, openssh, python, build-base). Only the Go toolchain under /usr/local/go differs. The Go versions and platforms (linux/amd64, linux/arm64) are set in build.env⁠.

⁠How old Go versions run on a current alpine

The toolchain is copied out of the official golang:<version>-alpine image. Up to Go 1.20 these toolchains were built from source on alpine, so they only link against musl, which is backwards compatible. From Go 1.21 on the toolchain is statically linked. No old alpine packages are needed. cgo uses the gcc from the current alpine, and the image smoke test checks that it works for every version.

To stay independent of Docker Hub, CI copies the official images into Harbor (ideaplexus/go-toolchain:<version>, only the platforms in build.env) and builds from there (ci/mirror.sh⁠):

• EOL versions are copied only once. They never change, and the copy stays even if the upstream tag disappears.
• The newest two versions are supported and copied again on every run to pick up patch releases.

⁠Pipeline

mirror:toolchain mirrors the toolchains and generates a child pipeline with one build and one scan job per Go version (ci/generate-pipeline.sh⁠). On main the images are pushed as go:<version>, the newest also as go:latest. On every other branch the tags get a -<branch> suffix, so an unmerged change never replaces a published image.

A nightly pipeline schedule on main rebuilds everything. That picks up Go patch releases and alpine security fixes without any change to the repository.

⁠Renovate

renovate.json⁠ keeps these up to date:

• GO_LATEST in build.env. A new Go release is merged automatically once all images build; the merge pipeline adds the new image and moves the oldest supported version to EOL.
• The alpine version and the apk pins in the Dockerfile, together in one merge request, because the pins have to match the packages of that release.
• The python packages installed with pip.
• The crane image and the CI components.

⁠Same environment as the official images

PATH, GOPATH, GOLANG_VERSION, GOTOOLCHAIN (Go 1.21+) and the working directory /go match the official golang:<version>-alpine image exactly. GOLANG_VERSION is the full patch version, so it is not hard-coded: ci/toolchain-env.sh⁠ reads the ENV of the toolchain image and turns it into build args (CI: mirror:toolchain, locally: the Makefile). It fails as soon as the official image sets a variable the Dockerfile does not reproduce. The smoke test checks that go version matches GOLANG_VERSION.

⁠Build locally

make build-1.11                 # single version, toolchain from Docker Hub
make build                      # all versions
make build-1.11 PLATFORMS=linux/arm64   # single platform
make build TOOLCHAIN_IMAGE='harbor.ideaplexus.com/ideaplexus/go-toolchain:$*'

Docker Hub images are pulled through the registry cache docker.registry-cache.ideaplexus.com/, which only answers in the LAN. Outside the LAN, or to change any other variable, put an override into .env:

echo 'PROXY_CACHE_PREFIX=' > .env   # pull directly from Docker Hub

They are referenced as library/<name>, because the registry cache does not resolve bare names such as golang.