The Stack Map

The language itself, its garbage collector, and scheduler.

Go 1.22+

1.22 fixed the loop-variable capture footgun and added range-over-integer; 1.21 added the cmp/slices/maps packages. Stay on a recent toolchain — upgrades are cheap and backward-compatible.

Resolve packages, pin versions, produce a binary.

Go modules + the go command

go.mod / go.sum are built in; `go build` cross-compiles with GOOS/GOARCH and needs no external build tool. Reach for a Makefile only to script multi-step tasks.

Prove behavior; benchmark; detect races.

stdlib testing (table-driven) + go test -race

The standard library is enough for almost everything. Add testify/require only if you want terser assertions; reach for a mocking lib rarely — small interfaces + hand-written fakes beat generated mocks.

Catch bugs the compiler allows.

golangci-lint (bundles go vet, staticcheck, …)

Run go vet always; golangci-lint aggregates the high-value linters behind one config and one command. staticcheck alone is a great minimal step up.

Serve and route HTTP.

net/http ServeMux (1.22); chi for middleware

1.22's ServeMux added method + wildcard patterns, so the stdlib covers most APIs. Reach for chi when you want composable middleware stacks; full frameworks (echo, gin) only when you want batteries included.

Talk to a database with type safety.

pgx + sqlc (Postgres)

database/sql is the portable baseline; pgx is the fast Postgres driver, and sqlc generates type-safe Go from your SQL. Reach for an ORM (GORM) only when you want convenience over control.

Parse flags, env, and subcommands.

flag (stdlib); cobra for multi-command CLIs

The stdlib flag package handles simple tools. cobra (+ viper for config) earns its weight once you have many subcommands and rich help.

Structured, leveled logs.

log/slog

slog landed in the stdlib in 1.21 — structured key/value logging with levels and handlers. No reason to add zap/zerolog unless you've measured a hot-path allocation problem.

Coordinate goroutines safely.

go test -race + golang.org/x/sync (errgroup)

The race detector is non-negotiable in CI. errgroup gives you bounded fan-out with first-error cancellation; semaphore caps concurrency when a worker pool is overkill.

Profile and trace in production.

net/http/pprof + OpenTelemetry

pprof ships with the runtime — CPU, heap, goroutine, and block profiles for free. OpenTelemetry is the vendor-neutral choice for traces and metrics across services.

Package the binary for production.

multi-stage Docker → distroless/static

A static Go binary (CGO_ENABLED=0) drops into a distroless or scratch image for a tiny, attack-surface-minimal container. ko is a nice alternative that skips the Dockerfile entirely.