chore: speed up docker build

[yashmehrotra]

Summary by CodeRabbit

• Chores
  • Improved Docker image builds for different target platforms.
  • Release versions are now passed through to Docker builds.
  • Streamlined the build process while preserving version and build-date metadata.

[coderabbitai]

Walkthrough

Changes

Docker release build

Layer / File(s)	Summary
Go build target Makefile	The build target now delegates compilation to go-build. The new target preserves linker metadata and waits for local binaries.
Docker platform build Dockerfile, .github/workflows/release.yml	The Dockerfile generates assets on the build platform, then cross-compiles for the target platform. The release workflow passes VERSION to the Docker build.

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant Dockerfile
  participant Generator
  participant GoBuild
  ReleaseWorkflow->>Dockerfile: Pass VERSION
  Dockerfile->>Generator: Generate OIDC assets, manifests, and UI
  Dockerfile->>GoBuild: Pass TARGETOS, TARGETARCH, and VERSION
  GoBuild-->>Dockerfile: Produce target-platform binary

Loading

Possibly related PRs

• flanksource/mission-control#3200: Related Docker release workflow and Makefile build changes.
• flanksource/mission-control#3381: Related multi-architecture Docker publishing changes.

Suggested reviewers: adityathebe, moshloop

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: improving Docker build speed through build-stage and build-argument updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ic-no-facet

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch ic-no-facet

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

Dockerfile (1)

1-1: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Update the Docker Go builder image.

Dockerfile uses golang:1.26.1-bookworm, while Go 1.26.5 includes security fixes and patch availability. The builder runs make manifests, so update its pinned digest to the current patched image; the generator stage is not copied into the runtime image.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` at line 1, Update the generator stage’s Go builder image from
golang:1.26.1-bookworm to golang:1.26.5-bookworm and replace its pinned digest
with the current digest for that exact image tag. Keep the existing
BUILDPLATFORM usage and generator stage structure unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile`:
- Line 1: Update the final runtime stage of the Dockerfile to create or use a
non-root user, change /app ownership to that user before switching, and add a
USER directive for runtime execution. Keep any go-offline step before the user
switch if it writes files, and leave the generator stage unchanged.
- Around line 17-18: Preserve the Makefile’s VERSION_TAG fallback by keeping the
Dockerfile VERSION build argument undefined, or update the docker target to pass
--build-arg VERSION="$(VERSION_TAG)" during the build. Align the Docker image’s
version with the tag used by the docker target without introducing a conflicting
Dockerfile default.

---

Nitpick comments:
In `@Dockerfile`:
- Line 1: Update the generator stage’s Go builder image from
golang:1.26.1-bookworm to golang:1.26.5-bookworm and replace its pinned digest
with the current digest for that exact image tag. Keep the existing
BUILDPLATFORM usage and generator stage structure unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ceb8e96-1bce-4904-90ee-4ff8c7a96859

📥 Commits

Reviewing files that changed from the base of the PR and between 0d07446 and 03b2ae3.

📒 Files selected for processing (3)

• .github/workflows/release.yml
• Dockerfile
• Makefile

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Run the final image as a non-root user.

Trivy DS-0002 reports that this Dockerfile produces a root user. Add a non-root USER in the final runtime stage. Set /app ownership before switching users. Keep go-offline before the switch if it writes files.

🧰 Tools

🪛 Trivy (0.72.0)

[error] 1-1: Image user should not be 'root'

Specify at least 1 USER command in Dockerfile with non-root user as argument

Rule: DS-0002

Learn more

(IaC/Dockerfile)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` at line 1, Update the final runtime stage of the Dockerfile to
create or use a non-root user, change /app ownership to that user before
switching, and add a USER directive for runtime execution. Keep any go-offline
step before the user switch if it writes files, and leave the generator stage
unchanged.

Source: Linters/SAST tools