FreeRADIUS · marc-casavant · Sep 4, 2026
diff --git a/.github/workflows/docker-freeradius-images-refresh.yml b/.github/workflows/docker-freeradius-images-refresh.yml
@@ -48,7 +48,7 @@ jobs:
   #                      FreeRADIUS build-deps
   #    profiling-deps    `FROM` `crossbuild:latest`, toolchain layer
   #                      (valgrind / kcachegrind / dbgsym / FlameGraph /
-  #                      inferno)
+  #                      inferno / pprof)
   #    service           `FROM` the same upstream OS base as 'crossbuild'
   #                      (NOT from 'crossbuild') - the FreeRADIUS
   #                      debian/rpm package build apt-installs build

diff --git a/scripts/docker/build/debian13/Dockerfile.profiling b/scripts/docker/build/debian13/Dockerfile.profiling
@@ -8,7 +8,7 @@ FROM ${from}
 
 #
 #  Per-commit profiling image. The slow toolchain layer (valgrind /
-#  kcachegrind / dbgsym / FlameGraph / inferno) lives in profiling-deps
+#  kcachegrind / dbgsym / FlameGraph / inferno / pprof) lives in profiling-deps
 #  and is refreshed periodically by docker-freeradius-images-refresh.yml; this layer just
 #  compiles FreeRADIUS with profiling-friendly CFLAGS on top of it.
 #  See common.freeradius-profile-build.m4 for the CFLAGS rationale.

diff --git a/scripts/docker/build/debian13/Dockerfile.profiling-deps b/scripts/docker/build/debian13/Dockerfile.profiling-deps
@@ -11,9 +11,8 @@ FROM ${from}
 #
 #    valgrind / cachegrind
 #    kcachegrind + KDE/Qt runtime libs (cachegrind annotation viewer)
-#    gperftools (libgoogle-perftools-dev ships the pprof binaries too,
-#    so we don't need the separate google-perftools package -- which
-#    has been retired from newer debian/ubuntu archives anyway)
+#    gperftools (`libgoogle-perftools-dev` provides libprofiler)
+#    pprof (Go pprof)
 #    heaptrack
 #
 RUN apt-get update && \
@@ -114,5 +113,29 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     cargo install inferno --version 0.11.21 --locked --root /usr/local && \
     rm -rf "$HOME/.cargo" "$HOME/.rustup"
 
+#
+#  Install the Go pprof (github.com/google/pprof). Only the Go pprof
+#  writes the `pprof -proto` output that the profiling server ingests.
+#  google/pprof has no release tags, so PPROF_COMMIT pins one commit.
+#  pprof needs Go 1.25 or newer.
+#
+RUN GO_VERSION=1.27.1 && \
+    GO_SHA256_AMD64=63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445 && \
+    GO_SHA256_ARM64=3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec && \
+    PPROF_COMMIT=d6c3cb2f37ec22719bbaf5eb031d9a46635cb5b2 && \
+    case "$(uname -m)" in \
+        x86_64)  GO_ARCH=amd64; GO_SHA256=$GO_SHA256_AMD64 ;; \
+        aarch64) GO_ARCH=arm64; GO_SHA256=$GO_SHA256_ARM64 ;; \
+        *) echo "go toolchain: no sha256 pinned for $(uname -m)" >&2; exit 1 ;; \
+    esac && \
+    curl --proto '=https' --tlsv1.2 -sSfL -o /tmp/go.tgz \
+        "https://dl.google.com/go/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz" && \
+    echo "${GO_SHA256}  /tmp/go.tgz" | sha256sum -c - && \
+    tar -C /usr/local -xzf /tmp/go.tgz && \
+    rm /tmp/go.tgz && \
+    GOPATH=/tmp/gopath GOCACHE=/tmp/gocache GOBIN=/usr/local/bin CGO_ENABLED=0 \
+        /usr/local/go/bin/go install "github.com/google/pprof@${PPROF_COMMIT}" && \
+    rm -rf /usr/local/go /tmp/gopath /tmp/gocache
+
 EXPOSE 1812/udp 1813/udp
 CMD ["/bin/sh", "-c", "while true; do sleep 60; done"]
diff --git a/scripts/docker/build/debiansid/Dockerfile.profiling b/scripts/docker/build/debiansid/Dockerfile.profiling
@@ -8,7 +8,7 @@ FROM ${from}
 
 #
 #  Per-commit profiling image. The slow toolchain layer (valgrind /
-#  kcachegrind / dbgsym / FlameGraph / inferno) lives in profiling-deps
+#  kcachegrind / dbgsym / FlameGraph / inferno / pprof) lives in profiling-deps
 #  and is refreshed periodically by docker-freeradius-images-refresh.yml; this layer just
 #  compiles FreeRADIUS with profiling-friendly CFLAGS on top of it.
 #  See common.freeradius-profile-build.m4 for the CFLAGS rationale.

diff --git a/scripts/docker/build/debiansid/Dockerfile.profiling-deps b/scripts/docker/build/debiansid/Dockerfile.profiling-deps
@@ -11,9 +11,8 @@ FROM ${from}
 #
 #    valgrind / cachegrind
 #    kcachegrind + KDE/Qt runtime libs (cachegrind annotation viewer)
-#    gperftools (libgoogle-perftools-dev ships the pprof binaries too,
-#    so we don't need the separate google-perftools package -- which
-#    has been retired from newer debian/ubuntu archives anyway)
+#    gperftools (`libgoogle-perftools-dev` provides libprofiler)
+#    pprof (Go pprof)
 #    heaptrack
 #
 RUN apt-get update && \
@@ -113,5 +112,29 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     cargo install inferno --version 0.11.21 --locked --root /usr/local && \
     rm -rf "$HOME/.cargo" "$HOME/.rustup"
 
+#
+#  Install the Go pprof (github.com/google/pprof). Only the Go pprof
+#  writes the `pprof -proto` output that the profiling server ingests.
+#  google/pprof has no release tags, so PPROF_COMMIT pins one commit.
+#  pprof needs Go 1.25 or newer.
+#
+RUN GO_VERSION=1.27.1 && \
+    GO_SHA256_AMD64=63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445 && \
+    GO_SHA256_ARM64=3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec && \
+    PPROF_COMMIT=d6c3cb2f37ec22719bbaf5eb031d9a46635cb5b2 && \
+    case "$(uname -m)" in \
+        x86_64)  GO_ARCH=amd64; GO_SHA256=$GO_SHA256_AMD64 ;; \
+        aarch64) GO_ARCH=arm64; GO_SHA256=$GO_SHA256_ARM64 ;; \
+        *) echo "go toolchain: no sha256 pinned for $(uname -m)" >&2; exit 1 ;; \
+    esac && \
+    curl --proto '=https' --tlsv1.2 -sSfL -o /tmp/go.tgz \
+        "https://dl.google.com/go/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz" && \
+    echo "${GO_SHA256}  /tmp/go.tgz" | sha256sum -c - && \
+    tar -C /usr/local -xzf /tmp/go.tgz && \
+    rm /tmp/go.tgz && \
+    GOPATH=/tmp/gopath GOCACHE=/tmp/gocache GOBIN=/usr/local/bin CGO_ENABLED=0 \
+        /usr/local/go/bin/go install "github.com/google/pprof@${PPROF_COMMIT}" && \
+    rm -rf /usr/local/go /tmp/gopath /tmp/gocache
+
 EXPOSE 1812/udp 1813/udp
 CMD ["/bin/sh", "-c", "while true; do sleep 60; done"]
diff --git a/scripts/docker/build/rocky10/Dockerfile.profiling b/scripts/docker/build/rocky10/Dockerfile.profiling
@@ -8,7 +8,7 @@ FROM ${from}
 
 #
 #  Per-commit profiling image. The slow toolchain layer (valgrind /
-#  kcachegrind / debuginfo / FlameGraph / inferno) lives in
+#  kcachegrind / debuginfo / FlameGraph / inferno / pprof) lives in
 #  profiling-deps and is refreshed periodically by docker-freeradius-images-refresh.yml;
 #  this layer just compiles FreeRADIUS with profiling-friendly CFLAGS
 #  on top of it. See common.freeradius-profile-build.m4 for the CFLAGS

diff --git a/scripts/docker/build/rocky10/Dockerfile.profiling-deps b/scripts/docker/build/rocky10/Dockerfile.profiling-deps
@@ -11,7 +11,8 @@ FROM ${from}
 #
 #    valgrind / cachegrind
 #    kcachegrind
-#    gperftools
+#    gperftools (the gperftools packages provide libprofiler)
+#    pprof (Go pprof)
 #    heaptrack
 #
 #  EPEL is enabled by common.rpm.toolchain.m4 in the crossbuild base
@@ -98,5 +99,29 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     cargo install inferno --version 0.11.21 --locked --root /usr/local && \
     rm -rf "$HOME/.cargo" "$HOME/.rustup"
 
+#
+#  Install the Go pprof (github.com/google/pprof). Only the Go pprof
+#  writes the `pprof -proto` output that the profiling server ingests.
+#  google/pprof has no release tags, so PPROF_COMMIT pins one commit.
+#  pprof needs Go 1.25 or newer.
+#
+RUN GO_VERSION=1.27.1 && \
+    GO_SHA256_AMD64=63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445 && \
+    GO_SHA256_ARM64=3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec && \
+    PPROF_COMMIT=d6c3cb2f37ec22719bbaf5eb031d9a46635cb5b2 && \
+    case "$(uname -m)" in \
+        x86_64)  GO_ARCH=amd64; GO_SHA256=$GO_SHA256_AMD64 ;; \
+        aarch64) GO_ARCH=arm64; GO_SHA256=$GO_SHA256_ARM64 ;; \
+        *) echo "go toolchain: no sha256 pinned for $(uname -m)" >&2; exit 1 ;; \
+    esac && \
+    curl --proto '=https' --tlsv1.2 -sSfL -o /tmp/go.tgz \
+        "https://dl.google.com/go/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz" && \
+    echo "${GO_SHA256}  /tmp/go.tgz" | sha256sum -c - && \
+    tar -C /usr/local -xzf /tmp/go.tgz && \
+    rm /tmp/go.tgz && \
+    GOPATH=/tmp/gopath GOCACHE=/tmp/gocache GOBIN=/usr/local/bin CGO_ENABLED=0 \
+        /usr/local/go/bin/go install "github.com/google/pprof@${PPROF_COMMIT}" && \
+    rm -rf /usr/local/go /tmp/gopath /tmp/gocache
+
 EXPOSE 1812/udp 1813/udp
 CMD ["/bin/sh", "-c", "while true; do sleep 60; done"]
diff --git a/scripts/docker/build/rocky9/Dockerfile.profiling b/scripts/docker/build/rocky9/Dockerfile.profiling
@@ -8,7 +8,7 @@ FROM ${from}
 
 #
 #  Per-commit profiling image. The slow toolchain layer (valgrind /
-#  kcachegrind / debuginfo / FlameGraph / inferno) lives in
+#  kcachegrind / debuginfo / FlameGraph / inferno / pprof) lives in
 #  profiling-deps and is refreshed periodically by docker-freeradius-images-refresh.yml;
 #  this layer just compiles FreeRADIUS with profiling-friendly CFLAGS
 #  on top of it. See common.freeradius-profile-build.m4 for the CFLAGS

diff --git a/scripts/docker/build/rocky9/Dockerfile.profiling-deps b/scripts/docker/build/rocky9/Dockerfile.profiling-deps
@@ -11,7 +11,8 @@ FROM ${from}
 #
 #    valgrind / cachegrind
 #    kcachegrind
-#    gperftools
+#    gperftools (the gperftools packages provide libprofiler)
+#    pprof (Go pprof)
 #    heaptrack
 #
 #  EPEL is enabled by common.rpm.toolchain.m4 in the crossbuild base
@@ -98,5 +99,29 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     cargo install inferno --version 0.11.21 --locked --root /usr/local && \
     rm -rf "$HOME/.cargo" "$HOME/.rustup"
 
+#
+#  Install the Go pprof (github.com/google/pprof). Only the Go pprof
+#  writes the `pprof -proto` output that the profiling server ingests.
+#  google/pprof has no release tags, so PPROF_COMMIT pins one commit.
+#  pprof needs Go 1.25 or newer.
+#
+RUN GO_VERSION=1.27.1 && \
+    GO_SHA256_AMD64=63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445 && \
+    GO_SHA256_ARM64=3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec && \
+    PPROF_COMMIT=d6c3cb2f37ec22719bbaf5eb031d9a46635cb5b2 && \
+    case "$(uname -m)" in \
+        x86_64)  GO_ARCH=amd64; GO_SHA256=$GO_SHA256_AMD64 ;; \
+        aarch64) GO_ARCH=arm64; GO_SHA256=$GO_SHA256_ARM64 ;; \
+        *) echo "go toolchain: no sha256 pinned for $(uname -m)" >&2; exit 1 ;; \
+    esac && \
+    curl --proto '=https' --tlsv1.2 -sSfL -o /tmp/go.tgz \
+        "https://dl.google.com/go/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz" && \
+    echo "${GO_SHA256}  /tmp/go.tgz" | sha256sum -c - && \
+    tar -C /usr/local -xzf /tmp/go.tgz && \
+    rm /tmp/go.tgz && \
+    GOPATH=/tmp/gopath GOCACHE=/tmp/gocache GOBIN=/usr/local/bin CGO_ENABLED=0 \
+        /usr/local/go/bin/go install "github.com/google/pprof@${PPROF_COMMIT}" && \
+    rm -rf /usr/local/go /tmp/gopath /tmp/gocache
+
 EXPOSE 1812/udp 1813/udp
 CMD ["/bin/sh", "-c", "while true; do sleep 60; done"]
diff --git a/scripts/docker/build/ubuntu24/Dockerfile.profiling b/scripts/docker/build/ubuntu24/Dockerfile.profiling
@@ -8,7 +8,7 @@ FROM ${from}
 
 #
 #  Per-commit profiling image. The slow toolchain layer (valgrind /
-#  kcachegrind / dbgsym / FlameGraph / inferno) lives in profiling-deps
+#  kcachegrind / dbgsym / FlameGraph / inferno / pprof) lives in profiling-deps
 #  and is refreshed periodically by docker-freeradius-images-refresh.yml; this layer just
 #  compiles FreeRADIUS with profiling-friendly CFLAGS on top of it.
 #  See common.freeradius-profile-build.m4 for the CFLAGS rationale.

diff --git a/scripts/docker/build/ubuntu24/Dockerfile.profiling-deps b/scripts/docker/build/ubuntu24/Dockerfile.profiling-deps
@@ -11,9 +11,8 @@ FROM ${from}
 #
 #    valgrind / cachegrind
 #    kcachegrind + KDE/Qt runtime libs (cachegrind annotation viewer)
-#    gperftools (libgoogle-perftools-dev ships the pprof binaries too,
-#    so we don't need the separate google-perftools package -- which
-#    has been retired from newer debian/ubuntu archives anyway)
+#    gperftools (`libgoogle-perftools-dev` provides libprofiler)
+#    pprof (Go pprof)
 #    heaptrack
 #
 RUN apt-get update && \
@@ -116,5 +115,29 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     cargo install inferno --version 0.11.21 --locked --root /usr/local && \
     rm -rf "$HOME/.cargo" "$HOME/.rustup"
 
+#
+#  Install the Go pprof (github.com/google/pprof). Only the Go pprof
+#  writes the `pprof -proto` output that the profiling server ingests.
+#  google/pprof has no release tags, so PPROF_COMMIT pins one commit.
+#  pprof needs Go 1.25 or newer.
+#
+RUN GO_VERSION=1.27.1 && \
+    GO_SHA256_AMD64=63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445 && \
+    GO_SHA256_ARM64=3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec && \
+    PPROF_COMMIT=d6c3cb2f37ec22719bbaf5eb031d9a46635cb5b2 && \
+    case "$(uname -m)" in \
+        x86_64)  GO_ARCH=amd64; GO_SHA256=$GO_SHA256_AMD64 ;; \
+        aarch64) GO_ARCH=arm64; GO_SHA256=$GO_SHA256_ARM64 ;; \
+        *) echo "go toolchain: no sha256 pinned for $(uname -m)" >&2; exit 1 ;; \
+    esac && \
+    curl --proto '=https' --tlsv1.2 -sSfL -o /tmp/go.tgz \
+        "https://dl.google.com/go/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz" && \
+    echo "${GO_SHA256}  /tmp/go.tgz" | sha256sum -c - && \
+    tar -C /usr/local -xzf /tmp/go.tgz && \
+    rm /tmp/go.tgz && \
+    GOPATH=/tmp/gopath GOCACHE=/tmp/gocache GOBIN=/usr/local/bin CGO_ENABLED=0 \
+        /usr/local/go/bin/go install "github.com/google/pprof@${PPROF_COMMIT}" && \
+    rm -rf /usr/local/go /tmp/gopath /tmp/gocache
+
 EXPOSE 1812/udp 1813/udp
 CMD ["/bin/sh", "-c", "while true; do sleep 60; done"]
diff --git a/scripts/docker/build/ubuntu26/Dockerfile.profiling b/scripts/docker/build/ubuntu26/Dockerfile.profiling
@@ -8,7 +8,7 @@ FROM ${from}
 
 #
 #  Per-commit profiling image. The slow toolchain layer (valgrind /
-#  kcachegrind / dbgsym / FlameGraph / inferno) lives in profiling-deps
+#  kcachegrind / dbgsym / FlameGraph / inferno / pprof) lives in profiling-deps
 #  and is refreshed periodically by docker-freeradius-images-refresh.yml; this layer just
 #  compiles FreeRADIUS with profiling-friendly CFLAGS on top of it.
 #  See common.freeradius-profile-build.m4 for the CFLAGS rationale.

diff --git a/scripts/docker/build/ubuntu26/Dockerfile.profiling-deps b/scripts/docker/build/ubuntu26/Dockerfile.profiling-deps
@@ -11,9 +11,8 @@ FROM ${from}
 #
 #    valgrind / cachegrind
 #    kcachegrind + KDE/Qt runtime libs (cachegrind annotation viewer)
-#    gperftools (libgoogle-perftools-dev ships the pprof binaries too,
-#    so we don't need the separate google-perftools package -- which
-#    has been retired from newer debian/ubuntu archives anyway)
+#    gperftools (`libgoogle-perftools-dev` provides libprofiler)
+#    pprof (Go pprof)
 #    heaptrack
 #
 RUN apt-get update && \
@@ -113,5 +112,29 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     cargo install inferno --version 0.11.21 --locked --root /usr/local && \
     rm -rf "$HOME/.cargo" "$HOME/.rustup"
 
+#
+#  Install the Go pprof (github.com/google/pprof). Only the Go pprof
+#  writes the `pprof -proto` output that the profiling server ingests.
+#  google/pprof has no release tags, so PPROF_COMMIT pins one commit.
+#  pprof needs Go 1.25 or newer.
+#
+RUN GO_VERSION=1.27.1 && \
+    GO_SHA256_AMD64=63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445 && \
+    GO_SHA256_ARM64=3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec && \
+    PPROF_COMMIT=d6c3cb2f37ec22719bbaf5eb031d9a46635cb5b2 && \
+    case "$(uname -m)" in \
+        x86_64)  GO_ARCH=amd64; GO_SHA256=$GO_SHA256_AMD64 ;; \
+        aarch64) GO_ARCH=arm64; GO_SHA256=$GO_SHA256_ARM64 ;; \
+        *) echo "go toolchain: no sha256 pinned for $(uname -m)" >&2; exit 1 ;; \
+    esac && \
+    curl --proto '=https' --tlsv1.2 -sSfL -o /tmp/go.tgz \
+        "https://dl.google.com/go/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz" && \
+    echo "${GO_SHA256}  /tmp/go.tgz" | sha256sum -c - && \
+    tar -C /usr/local -xzf /tmp/go.tgz && \
+    rm /tmp/go.tgz && \
+    GOPATH=/tmp/gopath GOCACHE=/tmp/gocache GOBIN=/usr/local/bin CGO_ENABLED=0 \
+        /usr/local/go/bin/go install "github.com/google/pprof@${PPROF_COMMIT}" && \
+    rm -rf /usr/local/go /tmp/gopath /tmp/gocache
+
 EXPOSE 1812/udp 1813/udp
 CMD ["/bin/sh", "-c", "while true; do sleep 60; done"]
diff --git a/scripts/docker/dockerfile.mk b/scripts/docker/dockerfile.mk
@@ -116,7 +116,7 @@ define DOCKER_HELP_TYPES
 	@echo "    service         production runtime image"
 	@echo "    ci              slim toolchain base for ci-deb.yml / ci-rpm.yml"
 	@echo "    crossbuild      full toolchain for docker-crossbuild.yml"
-	@echo "    profiling-deps  crossbuild + valgrind / gperftools / heaptrack / kcachegrind / debug symbols"
+	@echo "    profiling-deps  crossbuild + valgrind / gperftools / pprof / heaptrack / kcachegrind / debug symbols"
 	@echo "    profiling       profiling-deps + FreeRADIUS compiled with callgrind-friendly CFLAGS"
 endef
 

diff --git a/scripts/docker/m4/profiling-deps.deb.m4 b/scripts/docker/m4/profiling-deps.deb.m4
@@ -6,9 +6,8 @@ FROM ${from}
 #
 #    valgrind / cachegrind
 #    kcachegrind + KDE/Qt runtime libs (cachegrind annotation viewer)
-#    gperftools (libgoogle-perftools-dev ships the pprof binaries too,
-#    so we don't need the separate google-perftools package -- which
-#    has been retired from newer debian/ubuntu archives anyway)
+#    gperftools (`libgoogle-perftools-dev` provides libprofiler)
+#    pprof (Go pprof)
 #    heaptrack
 #
 RUN apt-get update && \
@@ -51,5 +50,29 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     cargo install inferno --version 0.11.21 --locked --root /usr/local && \
     rm -rf "$HOME/.cargo" "$HOME/.rustup"
 
+#
+#  Install the Go pprof (github.com/google/pprof). Only the Go pprof
+#  writes the `pprof -proto` output that the profiling server ingests.
+#  google/pprof has no release tags, so PPROF_COMMIT pins one commit.
+#  pprof needs Go 1.25 or newer.
+#
+RUN GO_VERSION=1.27.1 && \
+    GO_SHA256_AMD64=63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445 && \
+    GO_SHA256_ARM64=3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec && \
+    PPROF_COMMIT=d6c3cb2f37ec22719bbaf5eb031d9a46635cb5b2 && \
+    case "$(uname -m)" in \
+        x86_64)  GO_ARCH=amd64; GO_SHA256=$GO_SHA256_AMD64 ;; \
+        aarch64) GO_ARCH=arm64; GO_SHA256=$GO_SHA256_ARM64 ;; \
+        *) echo "go toolchain: no sha256 pinned for $(uname -m)" >&2; exit 1 ;; \
+    esac && \
+    curl --proto '=https' --tlsv1.2 -sSfL -o /tmp/go.tgz \
+        "https://dl.google.com/go/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz" && \
+    echo "${GO_SHA256}  /tmp/go.tgz" | sha256sum -c - && \
+    tar -C /usr/local -xzf /tmp/go.tgz && \
+    rm /tmp/go.tgz && \
+    GOPATH=/tmp/gopath GOCACHE=/tmp/gocache GOBIN=/usr/local/bin CGO_ENABLED=0 \
+        /usr/local/go/bin/go install "github.com/google/pprof@${PPROF_COMMIT}" && \
+    rm -rf /usr/local/go /tmp/gopath /tmp/gocache
+
 EXPOSE 1812/udp 1813/udp
 CMD ["/bin/sh", "-c", "while true; do sleep 60; done"]