Overview: Trim container footprint and lower CVE risk for Go applications with Red Hat Hardened Images and Red Hat build of Podman Desktop
Standard container images often include extra files that our applications do not need. These files increase the attack surface and can generate unnecessary alerts from security scanners. Red Hat Hardened Images are "distroless," meaning they contain only the essential files required to run our applications. If a file is not in a container, a scanner cannot flag it as a vulnerability. This allows us to focus on code quality rather than investigating irrelevant security reports.
In this guide, we will set up a development container first. This ensures that every developer on our team uses the exact same tools. We then use Go to develop our web application with RESTful API endpoints. Go's static compilation makes it ideal for containerized deployments because we can create a single binary with no runtime dependencies.
Prerequisites:
- Download the Red Hat build of Podman Desktop for Windows, macOS, or Red Hat Enterprise Linux (RHEL).
In this learning path, you will:
- Build a sample Go web application with RESTful endpoints.
- Build and run a Red Hat Hardened Image with the Red Hat build of Podman Desktop.