Context

In GODRIVER-3573 an image is created from this Dockerfile to test compilation of the driver over multiple versions and variants. The image is built then run on ever execution of the test. But this image should not change very often, only on upgrades of a go version of libmongocrypt.

Most other teams in MongoDB host images on ECR but that can cause issues with ECR access on a dev's machine and would likely not be accessible to outside contributors (but maybe theres a setting for this). A second option to consider is something like Github's container registry (GHCR), this would be through the Github repo and can be easily made public and run from github actions. Quay is possibly an option as well.

Definition of done

Investigate options to host the prebuilt image for use in the tests. If a viable solution is found update the compilecheck test to use this prebuilt image which will save time on test runs.

Optional: If something like this seems like a huge lift or a lot of maintenance for updating go versions it may be more feasible to create an image for the libmongocrypt part of the Dockerfile. This part is what takes the most time, and it may be useable outside of just the go driver.

Optional: Docker released hardened images which have minimal vulnerabilities and heightened security measures. While it may not have a large impact either way on a testcontainer, higher security from your source/base image is not a bad thing either.

Pitfalls

What should the implementer watch out for? What are the risks?