← BACK TO PIPELINEFORGE
DECISIONS

ENGINEERING TRADE-OFFS

The 99.3% Optimization

The original Docker image using golang:1.21 resulted in a massive 1.1GB artifact. By switching to a multi-stage build using gcr.io/distroless/static:nonroot, the final image was aggressively stripped down to 8MB.

Why Distroless?

  • No shell (/bin/sh)
  • No package managers
  • No OS utilities
  • Reduced CVE surface area to near-zero

Dockerfile Trace

FROM golang:1.25.7 AS builder
WORKDIR /build
COPY go.mod go.sum ./
RUN go mod download
COPY app/ ./app/
RUN CGO_ENABLED=0 GOOS=linux go build \
    -trimpath \
    -ldflags="-s -w" \
    -o /pipelineforge ./app/

FROM gcr.io/distroless/static:nonroot
COPY --from=builder /pipelineforge /pipelineforge
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["/pipelineforge"]

Security Gates: Trivy Integration

Security cannot be an afterthought. Integrating Aquasecurity's Trivy into the CI pipeline enforces a hard gate: if any CRITICAL or HIGH vulnerabilities are detected in the container layers, the build instantly fails and deployment is halted.

By explicitly enforcing this rule at the CI level before the image is pushed to the container registry, we adhere to the Shift Left paradigm, identifying flaws when they are cheapest to fix.

Trivy Gate

$ trivy image \
    --exit-code 1 \
    --severity HIGH,CRITICAL \
    pipelineforge:latest

2026-07-20T00:10:16Z
FATAL vulnerability found

Performance Metrics: k6 Load Test

To validate the Horizontal Pod Autoscaler (HPA) and readiness probes, a synthetic load was generated using k6. We slammed the /work endpoint with 500 concurrent Virtual Users (VUs).

  • ITERATIONS120,531
  • AVG HTTP REQ DURATION4.12ms
  • SUCCESS RATE (200 OK)100.00%
  • HPA SCALING1 Pod → 8 Pods
running (1m00.1s), 500/500 VUs, 120531 complete iterations
default ✓ [======================================] 500 VUs  1m0s

     ✓ status was 200

     checks.........................: 100.00% ✓ 120531      ✗ 0
     http_req_duration..............: 4.12ms  avg=4.12ms max=45.12ms
     vus............................: 500     min=500       max=500

[SYSTEM] Horizontal Pod Autoscaler triggered
[SYSTEM] Replicas scaled from 1 -> 8 (CPU > 70%)