Multi-stage `Dockerfile` builds

[emk]

There's an interesting pattern that shows up in several of our internal applications, especially those using Go or Rust. In particular, we have two Dockerfiles:

• Dockerfile.build contains a complete development toolchain, which may be several hundred megabytes in size, and which may rely on a full-fledged distro like Ubuntu. We use this image to build a statically-linked binary.
• Dockerfile contains a minimalistic Alpine image. We simply drop our static binary into this image, and the result is often less than 30MB in size.

We may want to make this pattern "official", and provide support for handling it automatically when we invoke cage build.

A possible design

The design could be fairly simple. We might just add something like the following to an individual service:

label:
  io.fdy.cage.build_outputs: "/app/my_static_binary"

...or perhaps instead to config/sources.yml:

myimage:
  prebuild:
    dockerfile: "Dockerfile.prebuild"
    outputs:
      my_static_binary: "/app/my_static_binary"

Then we could simply define a Dockerfile.prebuild in the source directory.

[emk]

@dkastner votes for the source.yml-based design.

[emk]

This is now officially supported upstream! See https://docs.docker.com/engine/userguide/eng-image/multistage-build/

We want to support this, and it should work just fine for ordinary builds. cage test, however, might be a bit more complicated, and we need to think it through.

[emk]

Note that multi-stage builds require Docker 17.05, but ECS is still on 17.03: http://docs.aws.amazon.com/AmazonECS/latest/developerguide/container_agent_versions.html