Update Dockerfile go version to 1.25

[m-Peter]

Description

The go version was updated to 1.25 in the go.mod file, so we need to update the Dockerfile version as well.

---

For contributor use:

• Targeted PR against master branch
• Linked to Github issue with discussion and accepted design OR link to spec that describes this work.
• Code follows the standards mentioned here.
• Updated relevant documentation
• Re-reviewed Files changed in the Github PR explorer
• Added appropriate labels

Summary by CodeRabbit

• Chores
  • Upgraded the build environment to Go 1.25. Users may notice more consistent builds, compatibility with newer tooling, and potential performance improvements during build and CI processes. No functional changes to application behavior are expected. No action required; existing workflows and deployments should continue to operate as before.

[coderabbitai]

Walkthrough

The Dockerfile’s base image for the app-builder was updated from golang:1.23 to golang:1.25. No other modifications were made.

Changes

Cohort / File(s)	Summary
Container base image update Dockerfile	Updated Go base image tag from 1.23 to 1.25; no other edits.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• Revamp Dockerfile #248 — Also updates the Dockerfile’s Go base image version.
• Update Dockerfile #386 — Adjusts the Dockerfile to a newer Go version (1.20→1.22), similar scope.
• Revert "bug, hardcode version" #388 — Changes the Dockerfile’s Golang toolchain version tied to build behavior.

Suggested reviewers

• zhangchiqing
• janezpodhostnik
• peterargue

Pre-merge checks (3 passed)

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title "Update Dockerfile go version to 1.25" is concise, directly describes the primary change (updating the Dockerfile Go base image to 1.25) and matches the PR objective of aligning the Dockerfile with the go.mod update, so it accurately summarizes the main change without extraneous detail.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

Poem

Hop hop, new Go I spy,
From 1.23 to .25 we fly.
Lighter layers, carrots bright,
Builder buns compile just right.
In docker fields we swiftly thrive—
Ship the burrow, press “go,” and drive! 🥕🐇

Tip

👮 Agentic pre-merge checks are now available in preview!

Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.

• Built-in checks – Quickly apply ready-made checks to enforce title conventions, require pull request descriptions that follow templates, validate linked issues for compliance, and more.
• Custom agentic checks – Define your own rules using CodeRabbit’s advanced agentic capabilities to enforce organization-specific policies and workflows. For example, you can instruct CodeRabbit’s agent to verify that API documentation is updated whenever API schema files are modified in a PR. Note: Upto 5 custom checks are currently allowed during the preview period. Pricing for this feature will be announced in a few weeks.

Please see the documentation for more information.

Example:

reviews:
  pre_merge_checks:
    custom_checks:
      - name: "Undocumented Breaking Changes"
        mode: "warning"
        instructions: |
          Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).

Please share your feedback with us on this Discord post.

✨ Finishing touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch mpeter/update-docker-golang-version

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

Dockerfile (1)

24-34: Pin runtime base (avoid latest) and slim the layer.

Using debian:latest is non-reproducible and pulls unnecessary packages. Pin to a stable slim variant and clean apt caches.

Apply:

-FROM debian:latest
+FROM debian:bookworm-slim

@@
-RUN apt-get update && apt-get install ca-certificates -y
+RUN apt-get update \
+ && apt-get install --no-install-recommends -y ca-certificates \
+ && rm -rf /var/lib/apt/lists/*

Optional: add a non-root user and drop privileges.

+RUN useradd -r -u 10001 appuser
+USER appuser

🧹 Nitpick comments (2)

Dockerfile (2)

15-21: Use standard buildx args (TARGETOS/TARGETARCH) and add cache mounts.

Current ARG ARCH may be unset under buildx, yielding host-arch builds. Prefer TARGETOS/TARGETARCH and build cache mounts for speed.

 ARG VERSION
-ARG ARCH
+ARG ARCH
+ARG TARGETOS
+ARG TARGETARCH
@@
-RUN CGO_ENABLED=1 GOOS=linux GOARCH=$ARCH go build -o bin -ldflags="-X github.com/onflow/flow-evm-gateway/api.Version=$VERSION" -trimpath cmd/main.go
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=1 \
+    GOOS=${TARGETOS:-linux} \
+    GOARCH=${ARCH:-${TARGETARCH:-amd64}} \
+    go build -o bin \
+      -ldflags="-s -w -X github.com/onflow/flow-evm-gateway/api.Version=$VERSION" \
+      -trimpath cmd/main.go

---

3-3: Pin builder variant for reproducibility.

Explicitly choose a Debian suite to avoid sudden base changes; Alpine may complicate CGO.

-FROM golang:1.25 as app-builder
+FROM golang:1.25-bookworm as app-builder

If you need stronger guarantees, pin by digest.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 12eaf53 and e080ba7.

📒 Files selected for processing (1)

• Dockerfile (1 hunks)

🧰 Additional context used

🧠 Learnings (2)

📓 Common learnings

Learnt from: m-Peter
PR: onflow/flow-evm-gateway#738
File: .github/workflows/ci.yml:19-19
Timestamp: 2025-01-29T17:20:28.143Z
Learning: Go 1.23 was released and is available for use in CI/CD pipelines and Docker images.

📚 Learning: 2025-01-29T17:20:28.143Z

Learnt from: m-Peter
PR: onflow/flow-evm-gateway#738
File: .github/workflows/ci.yml:19-19
Timestamp: 2025-01-29T17:20:28.143Z
Learning: Go 1.23 was released and is available for use in CI/CD pipelines and Docker images.

Applied to files:

• Dockerfile

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Test

🔇 Additional comments (1)

Dockerfile (1)

3-3: Base image bump to Go 1.25 — verify CI/tooling and image availability.

• go.mod confirmed: line 3 -> go 1.25.0.
• .github/workflows search found no go-version/GOVERSION matches; verify CI steps (setup-go actions, build matrices), linters, and other tooling reference 1.25.
• Docker check couldn't run here (docker not installed). Run locally or in CI: docker buildx imagetools inspect docker.io/library/golang:1.25 and confirm the tag exists for required architectures.