Skip to content
This repository has been archived by the owner on Sep 9, 2020. It is now read-only.

Document how to use dep with Docker #1094

Merged
merged 7 commits into from
Sep 19, 2017
Merged
26 changes: 25 additions & 1 deletion docs/FAQ.md
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ Summarize the question and quote the reply, linking back to the original comment
* [Is it OK to make backwards-incompatible changes now?](#is-it-ok-to-make-backwards-incompatible-changes-now)
* [My dependers don't use `dep` yet. What should I do?](#my-dependers-dont-use-dep-yet-what-should-i-do)
* [How do I configure a dependency that doesn't tag its releases?](#how-do-i-configure-a-dependency-that-doesnt-tag-its-releases)
* [How do I use `dep` with Docker?](#how-do-i-use-dep-with-docker)

## Concepts
### Does `dep` replace `go get`?
Expand Down Expand Up @@ -302,7 +303,6 @@ For a refresher on Go's recommended workspace organization, see the ["How To Wri
`dep init -gopath`, which falls back to network mode when the packages are not
found in `GOPATH`. `dep ensure` doesn't work with projects in `GOPATH`.


## Best Practices
### Should I commit my vendor directory?

Expand Down Expand Up @@ -391,3 +391,27 @@ stripping out nested `vendor` directories.
## How do I configure a dependency that doesn't tag its releases?

Add a constraint to `Gopkg.toml` that specifies `branch: "master"` (or whichever branch you need) in the `[[constraint]]` for that dependency. `dep ensure` will determine the current revision of your dependency's master branch, and place it in `Gopkg.lock` for you. See also: [What is the difference between Gopkg.toml and Gopkg.lock?](#what-is-the-difference-between-gopkgtoml-the-manifest-and-gopkglock-the-lock)

## How do I use `dep` with Docker?

`dep ensure -vendor-only` creates the vendor folder from a valid `Gopkg.toml` and `Gopkg.lock` without checking for Go code.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, dep ensure -vendor-only care about Gopkg.lock only. But it still requires Gopkg.toml to exists. 😁

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah that threw me off too for a sec but the FAQ is less about "how things are exactly implemented" and more high level, "you need both a toml and lock in order for this to work" type stuff. 😀

I vote for leaving it as-is for now since both files are required.

This is especially useful for builds inside docker utilizing cache layers.

Sample dockerfile:

FROM golang:1.9 AS builder

RUN curl -fsSL -o /usr/local/bin/dep https://github.com/golang/dep/releases/download/vX.X.X/dep-linux-amd64 && chmod +x /usr/local/bin/dep

RUN mkdir -p /go/src/github.com/***
WORKDIR /go/src/github.com/***

COPY Gopkg.toml Gopkg.lock ./
# copies the Gopkg.toml and Gopkg.lock to WORKDIR

RUN dep ensure -vendor-only
# install the dependencies without checking for go code

...