Build an image, not a development machine

Use a build stage with the compiler and verified dependencies, then copy only the runtime artifact and required assets into a smaller runtime stage. Pin base images/dependencies according to the release policy and avoid secrets in layers.

A static pure-Go binary may fit a minimal image, but cgo, CA roots, timezone data and native libraries change requirements. A scratch image does not magically supply certificates or a shell.

Run as a non-root user when feasible, keep writable locations explicit, and handle signals in the actual application process. Rebuild for supported platforms and scan the final artifact, not only the builder.