baredevcontainer/golang repository overview

⁠golang

Dev container image with Go installed, built on the debian⁠ base image.

Like every image in this repository, it is minimal, built only from upstreams verified at build time, and published with SLSA provenance, a GitHub artifact attestation, and an SBOM; it runs as the non-root user dev. Why these images⁠ explains the reasoning, and Verifying the image⁠ below shows how to check a build.

⁠Image

ghcr.io/bare-devcontainer/golang:<tag>

Reference it from .devcontainer/devcontainer.json, pinning the digest as well as the tag:

{
  "image": "ghcr.io/bare-devcontainer/golang:1.26@sha256:<digest>"
}

⁠Dev Container Template

A ready-to-use Dev Container template for this image is available at bare-devcontainer/templates⁠. It provides the recommended configuration for this image, including security hardening and volume mounts that persist cache directories for faster rebuilds.

⁠Tags

Tags are also published with a date suffix on each build (e.g., 1.27.1-trixie-<YYYYMMDD>).

⁠Installed software

Everything from the debian⁠ base image, plus:

• Go toolchain⁠
• gopls⁠
• pkg-config, so cgo works out of the box

GOPATH is Go's own default of $HOME/go, which is /home/dev/go. /usr/local/go/bin is on PATH, and ${GOPATH}/bin is too under a Dev Container client, so a tool installed with go install resolves. Running the image without one (docker run, a CI job's container:) leaves ${GOPATH}/bin off PATH.

⁠Not installed

• No linters or debuggers. golangci-lint, staticcheck, and delve are absent; install the versions the project pins with go install.
• No cross-compilation sysroots. Pure-Go cross builds work as usual, but cgo builds targeting another platform need their own toolchain.

Unlike the version-manager images, the Go toolchain here is fixed by the image tag. A project that raises its go directive past the installed version will fall back to Go's own toolchain download unless GOTOOLCHAIN=local is set; pick the matching image tag instead.

⁠Supply chain

The Go toolchain is downloaded directly from go.dev⁠ and verified against Google's GPG signature before installation. The signing key (golang/google-linux-signing-key.asc) is committed to this repository, so signatures are checked against a key reviewed here rather than one fetched at build time. gopls is built from source in a throwaway builder stage at a pinned version, and only the resulting binary is copied into the final image.

⁠Verifying the image

Every build is published with SLSA provenance, a GitHub artifact attestation, and an SBOM. The attestation confirms that an image was built by the release workflow of this repository and has not been altered since:

gh attestation verify oci://ghcr.io/bare-devcontainer/golang:<tag>@sha256:<digest> \
  --owner bare-devcontainer

The Docker Hub mirror carries the same digests, so the same command verifies an image pulled from docker.io/baredevcontainer/golang. Verifying Published Images⁠ covers inspecting the provenance and the SBOM as well.