One of my favourite Go security features is the single binary output, it means I can build my binaries into a distroless base image container for running in K8S

One of my favourite Go security features is the single binary output, it means I can build my binaries into a distroless base image container for running in K8S. It removes a huge attack and vulnerability surface that containers introduce. My team uses Go whereas the rest of the company heavily uses Python. Our vulnerability scanner tool detects hundreds of high score CVEs just in their container images. Comparably there have been times I haven’t updated our distroless base image for a year and there isn’t even a single vulnerability (this one: https://github.com/GoogleContainerTools/distroless/blob/main/base/README.md https://github.com/GoogleContainerTools/distroless/blob/main...) In terms of defending your software supply chain, eliminating the cruft that is required to run an interpreted language in a container make a a huge difference.