> If anything, easy containerization negates one of Go's strongest selling points (i.e. standalone executables with no need for a runtime environment).
I don't know about that, I think that is still a strong selling point for Go, even in a containerized environment. Somewhere I saw a statistic that says over 90% of container images in the wild contain unpatched CVE vulnerabilities and (searching...) [1] here's an article that shows just how bad the problem is, according to this article in just the top 10 docker images, there are over 8000 known vulnerable paths.
The reason is probably not because those 10 products are simply nightmarish from a security perspective and expose the lions share of the vulnerabilities in their own code paths, it's because of unchecked dependencies. If someone took a tree shaker to those images and removed all of the unnecessary packages that aren't real dependencies, you see that number going down by probably about 30% if not more.
Even then, you're still seeing lots of potential issues caused by far-away dependencies that we do actually need, but don't really care about. There's something to be said for a development stack that is geared toward automatically pruning out packages you've included when the compiler can prove you're not even using them, and helping you reduce the scope and size of your external, far-away dependencies.
From an InfoSec perspective that's the biggest problem I see in containerized environments, (and true that just not using containers won't really make it much better) so correct me if I'm wrong, but I think that Go does all of that for us.
[1]: https://snyk.io/blog/top-ten-docker-images-contain-over-8000...