Skip to content

Strip debug info from the release binary (-s -w)#333

Open
gecube wants to merge 1 commit into
coroot:mainfrom
gecube:strip-release-binary
Open

Strip debug info from the release binary (-s -w)#333
gecube wants to merge 1 commit into
coroot:mainfrom
gecube:strip-release-binary

Conversation

@gecube

@gecube gecube commented Jul 6, 2026

Copy link
Copy Markdown

What

Add -s -w to the build -ldflags so the shipped binary no longer carries the full symbol and DWARF tables.

Why

Related to #249. The binary is currently built and released unstripped (file reports with debug_info, not stripped), so every release ships the .symtab/.strtab and .debug_* sections.

This doesn't fix the underlying growth from the cilium/cilium bump (that's genuinely more compiled code — .text/.gopclntab/.rodata), but it's a cheap, low-risk win on the packaging side.

Verification

Built current main twice (Go 1.24.9), identical flags except -s -w:

build size file
current -ldflags 140.1 MB not stripped
+ -s -w 99.8 MB stripped (-28.8%)

Section diff — only debug/symbol tables are removed, no functional section is touched:

section        current   +(-s -w)
.text            40.8M     40.8M   (unchanged)
.gopclntab       34.0M     34.0M   (unchanged -> panic stack traces stay symbolized)
.rodata          23.2M     23.2M   (unchanged)
.symtab+.strtab  18.7M      0
.debug_*         21.5M      0

Checked on the resulting binary:

  • --version prints the injected version, so -ldflags -X still works alongside -s -w;
  • --help parses fine;
  • .gopclntab is retained, so runtime panic stack traces stay symbolized.

The only capability lost is attaching gdb/delve to the shipped binary (those need DWARF).

The binary is built and shipped unstripped, so releases carry the full
symbol and DWARF tables. Adding -s -w to the existing -ldflags drops the
.symtab/.strtab and .debug_* sections and shrinks the amd64 binary by
~29% (locally: 140.1 MB -> 99.8 MB) without touching any functional
section: .text, .gopclntab and .rodata are byte-identical, so runtime
panic stack traces remain symbolized. The only thing lost is attaching
gdb/delve to the shipped binary, which needs DWARF.

The -X version injection still works alongside -s -w (verified with
--version on the resulting binary).

Refs coroot#249

Signed-off-by: Gaál György <gb12335@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants