如何冻结具有依赖项的微型版本？

I want to build a docker image with a fixed version of micro and go dependencies. I plan to do it with dep:

git checkout git@github.com:micro/micro.git
dep ensure
git add Gopkg.toml
git add Gopkg.lock

# Build micro
CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -ldflags '-w' -i -o micro ./main.go 

# Build docker image
...

So, my question is does it the best solution to build consistent micro docker image?

In my case, dep looks great and fast enough, moreover, it's official dependency manager in go so I think it's a right choice.

An example of a Dockerfile can be:

FROM golang:1.9-alpine3.6 as builder

# Install package manager
RUN apk add --no-cache --virtual .go-dependencies git curl \
  && curl https://glide.sh/get | sh

# Copy files from context
WORKDIR /go/src/github.com/foo/bar
COPY . .

# Install project dependencies, test and build
RUN glide install \
  && go test ./... \
  && CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -ldflags '-w' -i -o ./entry ./main.go ./plugins.go

# Build final image with binary
FROM alpine:3.6
RUN apk add --update ca-certificates && \
    rm -rf /var/cache/apk/* /tmp/*
WORKDIR /
COPY --from=builder /go/src/github.com/foo/bar/entry .
ENTRYPOINT [ "/entry" ]

And the glide.yaml would look like this:

package: .
import:
- package: github.com/micro/go-micro
  version: ^0.3.0
  subpackages:
  - client
  - server
- package: github.com/micro/go-plugins
  version: ^0.6.1
  subpackages:
  - wrapper/trace/opentracing
  - broker/nats
  - transport/nats
- package: github.com/opentracing/opentracing-go
  version: ^1
- package: github.com/openzipkin/zipkin-go-opentracing
  version: ^0.3
testImport:
- package: github.com/golang/mock
  subpackages:
  - gomock
- package: github.com/smartystreets/goconvey
  subpackages:
  - convey