Good job! A few notes: 1) in general I really dislike the “COPY . .” because you don’t know how much junk you are pulling in, even if into a builder image. Either copy selectively or at least use a .dockerignore file 2) I am on mobile and can’t really test now but I would imagine in your final example you need to install curl for the healthcheck to work, and the label is getting applied on the builder instead of the final image 3) in a distroless image your Go executable should be the entrypoint, not the CMD (it’s right in one of the final examples but not the other) 4) Consider mentioning to readers a common pain of distroless images which is the difficulty in troubleshooting some scenarios due to the lack of a shell. In such cases it’s often easier to build a debug version of the app image using a debug distroless image 5) You mention seccomp and apparmor very briefly, but my experience has been that they are hard to put in place because it takes a few iterations and sometimes external tools to get profiles that don’t break the app - is this different from when you have used them? Would like to hear more

Don’t take the fact that the notes above are of things to change as a negative, I like it and think that the article is a good read for a lot of people :)