CodeBlanks Logo Icon CodeBlanks
Login Register

scratch image

Learn the minimal scratch-based image.

The scratch image

scratch is a completely empty base image: no shell, no package manager, not even /etc. It is enough for a statically built Go binary and the image is roughly the binary's size.

FROM scratch
COPY --from=builder /out/app /app
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
ENTRYPOINT ["/app"]

If you make HTTPS requests you must copy the CA certificates too.

distroless and time zones

gcr.io/distroless/static is very close to scratch but includes CA certificates, /etc/passwd and a non-root user. If time zone data is needed it can be embedded in Go:

import _ "time/tzdata"  // adds ~450 KB of time zone data to the binary

Then time.LoadLocation("Europe/Istanbul") works in an empty image too.

Practice Embedded time zone

Import _ "time/tzdata". Load the location with time.LoadLocation("Europe/Istanbul"); if there is no error, print the location's String().

Starter code

main.go
package main

import (
    "fmt"
    "time"
)

func main() {
    // buraya yaz
}

Sample solution

main.go
package main

import (
    "fmt"
    "time"
    _ "time/tzdata"
)

func main() {
    loc, err := time.LoadLocation("Europe/Istanbul")
    if err != nil {
        fmt.Println(err)
        return
    }
    fmt.Println(loc.String())
}

Expected output

Europe/Istanbul

Questions and answers

Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.

1 Why doesn't <code>docker exec -it app sh</code> work in a scratch-based container?

  • There is no shell (sh) in the image Correct answer
  • The port is closed
  • The Go binary blocks it
  • The user isn't root

Explanation: scratch contains only the files you copy; this shrinks the attack surface but makes debugging harder.

2 Empty base

Question 
FROM ____
COPY --from=builder /out/app /app
Answer 
FROM scratch
COPY --from=builder /out/app /app

Explanation: scratch is Docker's special empty image; it contains no files.

3 Base images

Term Meaning
golang Includes the compiler, large
alpine Small, with a shell
distroless Shell-less, with certificates
scratch Completely empty

All lessons in Advanced

1 Reflection

  1. The reflect package
  2. reflect.Type
  3. reflect.Value
  4. Reflecting struct fields
  5. Dynamic call
  6. Summary - Reflection

2 unsafe

  1. The unsafe package
  2. unsafe.Pointer
  3. Sizeof and Alignof
  4. Offsetof
  5. unsafe and slice
  6. Summary - unsafe

3 cgo

  1. What is cgo?
  2. Calling C code
  3. C data types
  4. Go-C conversion
  5. cgo and memory
  6. Summary - cgo

4 plugin

  1. The plugin package
  2. Building a plugin
  3. Loading a plugin
  4. Plugin symbol
  5. Plugin and error
  6. Summary - plugin

5 database/sql

  1. The database/sql package
  2. sql.Open
  3. Query and Exec
  4. Prepared statement
  5. Transaction
  6. Summary - database/sql

6 Middleware

  1. The middleware concept
  2. HTTP middleware
  3. Middleware chain
  4. Logging middleware
  5. Auth middleware
  6. Summary - Middleware

7 gRPC

  1. What is gRPC?
  2. Protobuf definition
  3. Compiling with protoc
  4. gRPC server
  5. gRPC client
  6. Summary - gRPC

8 Project: Microservice

  1. Service skeleton
  2. Database layer
  3. HTTP API
  4. Docker and deployment

9 Docker

  1. Dockerfile
  2. Multi-stage build
  3. scratch image
  4. docker-compose
  5. Build args and labels
  6. Summary - Docker

10 pprof

  1. What is pprof?
  2. CPU profiling
  3. Memory profiling
  4. go test -cpuprofile
  5. The trace tool
  6. Summary - pprof

11 Observability

  1. log/slog
  2. Metrics
  3. Tracing
  4. OpenTelemetry
  5. Health check
  6. Summary - Observability

12 Advanced final

  1. Challenge 1 - Reflection
  2. Challenge 2 - Microservice
  3. Challenge 3 - Performance
  4. Challenge 4 - Database