Zero‑Intrusion Observability for Go Apps Using Docker Multi‑Stage Builds

Background

With the rise of cloud‑native adoption, Golang has become increasingly popular. Compared with Java, Go is lightweight and easy to learn, but because Go binaries must be compiled before running, it loses some flexibility that Java gains from JVM‑based bytecode instrumentation. Traditional Go observability often requires source‑code changes or compile‑time injection tools to achieve the same effect as Java agents.

Docker Multi‑Stage Build

Docker allows image builds to be split into multiple stages, enabling the build stage to produce a binary that is then copied into a lightweight runtime stage.

# stage 1
FROM golang:1.22-alpine3.19 as builder
RUN go version
RUN go build -v -o /workspace/demo
# stage 2
FROM alpine
COPY --from=builder /workspace/demo /demo
export ENV1=e1
CMD ["/demo"]

Step 1: Replace Builder Image

By swapping the standard Golang builder image for the ARMS compilation image (which includes the instgo tool), the rest of the Dockerfile can remain unchanged while automatically gaining observability capabilities.

# stage 1
# Replace with ARMS builder image, keep other steps unchanged
FROM registry-cn-hangzhou.ack.aliyuncs.com/acs/golangbuilder-alpine-linux-amd64:0.0.1 as builder
RUN go version
RUN go build -v -o /workspace/demo
# stage 2
FROM alpine
COPY --from=builder /workspace/demo /demo
ENV ENV1=e1
CMD ["/demo"]

Step 2: Use ack‑onepilot

For a more flexible approach, the ARMS ack-onepilot component can be installed in an Alibaba Cloud ACK cluster. After installation, adding a few labels to the workload spec enables automatic instrumentation without rebuilding the image.

labels:
  aliyun.com/app-language: golang  # required, marks the app as Go
  armsPilotAutoEnable: 'on'
  armsPilotCreateAppName: "<your-deployment-name>"  # replace with your deployment name

Summary and Outlook

The non‑intrusive, Docker‑based observability solution dramatically reduces the cost of adding a Golang agent and has been commercialized on Alibaba Cloud. Originally designed to let users insert monitoring code without code changes, the technique also shows promise for service governance, code auditing, application security, and debugging. The solution has been open‑sourced to the OpenTelemetry community, inviting further exploration and contributions.