<p><strong>TLDR:</strong> This week’s Go content skews practical and infrastructure-heavy. Sliplane rebuilt their DNS layer in ~1000 lines of Go after hitting Hetzner’s record limits, cutting propagation from 90 minutes to near-instant. Lead Bank fixed a nasty Lambda telemetry race that was causing p99 timeouts to spike to 10 seconds. GitHub detailed how they use eBPF with the cilium/ebpf Go library to block circular dependencies during deployments. Trendyol also shared a real migration from Neo4j to Apache AGE worth reading if you’re running graph workloads on Postgres.</p>
<hr>
<h2>Sliplane’s custom DNS server in Go</h2>
<p>Sliplane hit Hetzner’s DNS record limits and got tired of 90-minute propagation delays, so they wrote their own DNS server in roughly 1000 lines of Go using miekg/dns. The design uses the hidden primary pattern: a private Go server handles zone data and pushes updates to Hetzner’s public secondaries via AXFR/IXFR, with Postgres LISTEN/NOTIFY as the event bus. One lesson worth noting: IXFR support is non-negotiable here because Hetzner Robot secondaries don’t reliably fall back to AXFR. The hidden primary approach also avoids vendor lock-in since AXFR and NOTIFY are standard protocols.</p>
<h2>Lambda telemetry flush race condition</h2>
<p>Lead Bank was seeing intermittent 504 timeouts caused by OpenTelemetry flush stalls blocking Lambda’s response path. Their fix uses the AWS Lambda Extensions API to defer flushing entirely: the handler returns immediately, and an internal extension withholds its NextEvent() call until the flush completes. The naive version of this — calling NextEvent() too early — caused race conditions under warm reuse. The revised design chains single-shot goroutines so each one spawns the next only after the flush finishes. Result: p99 dropped from occasional 10-second timeouts to 200ms.</p>
<h2>GitHub’s eBPF deployment safety net</h2>
<p>GitHub’s deployment scripts run on stateful hosts and could call back to <a href="http://github.com" target="_blank" rel="noopener nofollow">github.com</a> during an outage, which is exactly the wrong time for that to happen. Their solution uses BPF_PROG_TYPE_CGROUP_SKB and BPF_PROG_TYPE_CGROUP_SOCK_ADDR with the cilium/ebpf Go library to place deployment scripts in a cGroup, intercept DNS queries via a userspace proxy, and block domains on a deny list. eBPF Maps correlate blocked DNS requests back to specific PIDs and command lines so teams can actually find and fix the offending dependency. This shipped after a six-month rollout and has measurably improved incident recovery time.</p>
<h2>Trendyol migrates from Neo4j to Apache AGE</h2>
<p>Trendyol’s engineering team moved their graph workloads from Neo4j Enterprise to Apache AGE, the graph extension for Postgres. The interesting technical detail: variable-length path queries bypass indexes in AGE and were producing 3–5 second response times, so they replaced them with iterative fixed-depth traversals parallelized via Go goroutines. They also consolidated multiple relationship types into a single discriminated HAS edge to simplify writes. The trade-off is real — Neo4j is faster at raw graph traversal — but the team got unified infrastructure, CDC via logical replication, and predictable licensing costs in return.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Separation of concerns in Go:</strong> Solid walkthrough of splitting HTTP handler, service, repository, and model layers using interfaces and constructor-based dependency injection, with concrete before/after examples.</li>
<li><strong>AES-256-GCM in Anglerphish:</strong> Anglerphish (a GoPhish fork) adds opt-in application-layer encryption for sensitive DB fields using a versioned format (ENC:v1:) activated via a single environment variable, with full backward compatibility for mixed plaintext/encrypted data.</li>
<li><strong>Conditional expression in Go compiler:</strong> Someone added a ternary-style <code>if { } else { }</code> expression to the Go compiler in under 800 lines, walking through every stage from parsing to escape analysis — good read if you want to understand the compilation pipeline.</li>
<li><strong>Flat files vs SQLite benchmark:</strong> In-memory hash maps hit 97–169k req/s, binary search on disk ~40k, SQLite ~25k — all stable from 10k to 1M records. The post argues SQLite on a single server can handle ~90 million DAU, so most apps don’t need a database early.</li>
<li><strong>sync/atomic guide:</strong> Covers the typed API from Go 1.19 (atomic.Int64, atomic.Pointer[T]), CAS loops for rate limiting, and atomic pointer swaps for zero-downtime config reloads, plus honest guidance on when to just use sync.Mutex.</li>
<li><strong>Error translation in layered services:</strong> Pattern for defining domain sentinel errors (ErrNotFound, ErrConflict) in the service package, translating storage errors at the repository boundary using %w/%v, and mapping to HTTP/gRPC codes in a single handler function.</li>
<li><strong>Multi-arch Docker on GKE without QEMU:</strong> Uses Docker Buildx cross-compilation to produce linux/amd64 and linux/arm64 images under a single manifest, with ARM node pools showing 25–30% cost savings versus equivalent x86 instances.</li>
<li><strong>PlanetScale traffic control patterns for Postgres:</strong> Per-service isolation via Postgres roles, route-level SQLCommenter tagging via HTTP middleware, and tier-based limits for multi-tenant apps, with graceful degradation on SQLSTATE 53000.</li>
<li><strong><a href="http://lesiw.io/step" target="_blank" rel="noopener nofollow">lesiw.io/step</a> library:</strong> Rob Pike-inspired state machine pattern for multi-step Go programs where each step returns the next step function; uses generics for type safety and supports independent unit testing of each step.</li>
<li><strong>dot CLI scaffolding tool:</strong> TUI-driven project generator that produces REST APIs, CLIs, monorepos, and more from a survey, storing config in .dot/config.json with an extensible generator architecture.</li>
<li><strong>versitygw S3 gateway:</strong> Stateless, horizontally scalable S3 translation layer in Go that bridges S3 API requests to POSIX filesystems, Azure Blob, and other backends — one command turns a local filesystem into an S3-compatible server.</li>
<li><strong>wacli WhatsApp CLI:</strong> Built on the whatsmeow Go library, supports offline full-text search, message history sync, and file sends via the WhatsApp Web protocol as a linked device.</li>
</ul>


Go language updates, concurrency patterns, and community projects.

Go Digest

A practical Go-focused roundup covering four major case studies and a dozen smaller items. Sliplane built a custom DNS server in ~1000 lines of Go using the hidden primary pattern with miekg/dns and Postgres LISTEN/NOTIFY, cutting propagation from 90 minutes to near-instant. Lead Bank fixed a Lambda telemetry race condition where OpenTelemetry flush stalls caused p99 timeouts of 10 seconds, resolving it by deferring flushes via the AWS Lambda Extensions API. GitHub uses eBPF with the cilium/ebpf library to intercept DNS queries during deployments and block circular dependencies, correlating blocked requests to specific PIDs. Trendyol migrated graph workloads from Neo4j to Apache AGE on Postgres, replacing variable-length path queries with parallelized fixed-depth traversals via goroutines. Notable extras include a sync/atomic guide, multi-arch Docker on GKE, error translation patterns, and several Go library spotlights.

Go's hidden primary DNS trick, Lambda telemetry race fixed