Tooling & Deployment

A Java project assembles its toolchain from parts: a JDK, Maven or Gradle, plugins for formatting, linting, coverage and packaging, and a JVM at runtime. Go puts almost all of it in one go command and produces a single native executable with no runtime to install.

The go command

Formatting and linting

• gofmt settles style. Tabs, spacing and alignment are not configurable, so they are never debated in code review. Run it on save; goimports also adds and removes import lines.
• go vet catches real bugs: mismatched Printf verbs, copied mutexes, unreachable code, lost context cancel functions, malformed struct tags. go test runs a subset automatically.
• staticcheck is the most respected third-party analyser. golangci-lint runs it together with dozens of other linters (errcheck, gosec, revive, exhaustive) from one config file.
• go fix (revamped in Go 1.26) rewrites code to use newer idioms and APIs, for example replacing hand-written loops with slices.Contains or interface{} with any.
• govulncheck reports known vulnerabilities only when your code actually calls the affected function, which keeps the signal high.

Building: one static binary

# A static binary with no libc dependency (pure-Go code)
CGO_ENABLED=0 go build -o bin/api ./cmd/api

# Cross-compile: no toolchain to install for the target
GOOS=linux GOARCH=arm64 go build -o bin/api-linux-arm64 ./cmd/api
GOOS=windows GOARCH=amd64 go build -o bin/api.exe ./cmd/api

# Stamp a version at link time; strip paths for reproducible builds
go build -trimpath -ldflags "-s -w -X main.version=v1.4.2" -o bin/api ./cmd/api

# Which module versions went into a binary? (build info is embedded)
go version -m bin/api

Containers

# ---- build stage ----
FROM golang:1.27 AS build
WORKDIR /src

# Cache dependencies separately from source changes
COPY go.mod go.sum ./
RUN go mod download

COPY . .
RUN CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/api ./cmd/api

# ---- runtime stage: no shell, no package manager ----
FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /out/api /api
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["/api"]

Embedding files in the binary

// src/main/resources/templates/welcome.html
try (InputStream in = getClass()
        .getResourceAsStream("/templates/welcome.html")) {
    String html = new String(in.readAllBytes(), UTF_8);
}

import "embed"

// The files are compiled into the binary at build time
//go:embed templates/*.html
var templates embed.FS

//go:embed schema.sql
var schema string

//go:embed static
var static embed.FS

html, err := templates.ReadFile("templates/welcome.html")

// embed.FS plugs into http.FileServerFS and html/template
mux.Handle("GET /static/", http.FileServerFS(static))

Tuning the garbage collector