A container build for a Go API needs a full compiler toolchain and downloaded modules, but the running service only executes one compiled binary. Which Dockerfile approach keeps the deployed image small?
Show answer and explanation
Answer: D
A multi-stage Dockerfile uses one stage with the full toolchain to compile the program, then copies only the resulting binary into a small final image. Smaller images pull faster, cost less to store, and carry fewer packages that could contain vulnerabilities. The build tools never reach the runtime image.
Why the other options are wrong
- A. Keeping the compiler in production images increases size and attack surface, and a running service has no need to compile code at all.
- B. The module cache is a build-time artifact; committing it into the final layer bloats the image without making the binary run any differently.
- C. Object storage buckets are not container registries and cannot serve images to the runtime platform, so this approach does not produce a deployable image.