syscall & Pure-Go Alternatives to CGO

Many tasks that once required cgo now have pure-Go paths: golang.org/x/sys for syscalls, community ports of crypto and compression libraries, and stdlib packages that wrap OS APIs directly.

Choosing pure Go first keeps cross-compilation, static binaries, and CI simpler.

Summary

Prefer maintained pure-Go libraries when they cover your platform matrix and performance needs.

Reach for cgo when a vendor SDK, hardware driver, or OS API exists only as C headers without a safe Go wrapper.

The syscall package is deprecated for new code; use x/sys/unix, x/sys/windows, or stdlib os/net instead.

Recipe

Quick-reference recipe card - copy-paste ready.

import (
    "golang.org/x/sys/unix"
)
 
func openReadOnly(path string) (int, error) {
    fd, err := unix.Open(path, unix.O_RDONLY, 0)
    if err != nil {
        return -1, err
    }
    return fd, nil
}

When to reach for this:

• You need POSIX or Windows syscalls without linking custom C.
• CI must build with CGO_ENABLED=0.
• You want single-command cross-compiles (GOOS, GOARCH).
• An x/sys or stdlib wrapper already exists for the API.

Working Example

List directory entries with x/sys on Unix instead of cgo-wrapped libc.

package main
 
import (
    "fmt"
    "os"
 
    "golang.org/x/sys/unix"
)
 
func main() {
    dir, err := os.Open(".")
    if err != nil {
        panic(err)
    }
    defer dir.Close()
 
    // Prefer os.ReadDir in application code; unix.ReadDirent shows x/sys shape
    buf := make([]byte, 4096)
    for {
        n, err := unix.ReadDirent(int(dir.Fd()), buf)
        if err != nil || n == 0 {
            break
        }
        // Parse buf per unix.ParseDirent in production helpers
        fmt.Printf("read %d bytes of dirent data\n", n)
    }
}

What this demonstrates:

• File descriptors from os.File feed unix syscalls without cgo.
• golang.org/x/sys tracks platform differences per GOOS.
• Application code should usually prefer higher-level os APIs; x/sys is for gaps.

Deep Dive

How It Works

• Pure-Go syscall packages use assembly stubs or compiler intrinsics generated per platform to invoke the kernel trap interface.
• No C compiler is required; go build with CGO_ENABLED=0 still succeeds.
• golang.org/x/sys is the maintained home for low-level constants and functions; the stdlib syscall package is frozen for compatibility.
• Community ports (SQLite pure Go, imaging, crypto) reimplement algorithms in Go or use //go:embed for data tables instead of linking C.

Decision Signals

Common Pure-Go Sources

Go Notes

//go:build !cgo
 
package db
 
import _ "modernc.org/sqlite" // database/sql driver, no cgo

Mirror with //go:build cgo files when you must support both driver backends behind one sql.Open DSN scheme.

Gotchas

• Using deprecated syscall package for new code - Misses fixes in x/sys. Fix: Import golang.org/x/sys/unix or windows and migrate call sites.
• Assuming pure-Go means slower - Modern ports often match cgo for I/O bound work; CPU-bound crypto may differ. Fix: Benchmark on your workload before choosing.
• Picking mattn/go-sqlite3 in static CI - Requires cgo and musl/glibc care. Fix: Use modernc.org/sqlite when CGO_ENABLED=0 is non-negotiable.
• Reimplementing ioctl by guessing struct layouts - Breaks across kernel versions. Fix: Follow x/sys definitions or official OS docs; add build tags per arch.
• Ignoring build tags on optional cgo features - Consumers cannot compile without a C toolchain. Fix: Ship !cgo implementations or clear documentation of hard cgo requirement.
• RPC to avoid cgo when latency budget is microseconds - Network cost dwarfs saved build pain. Fix: Measure end-to-end before rejecting in-process cgo.

Alternatives

FAQs

Related

• CGO: Crossing the Go-C Boundary - When the C bridge is justified
• CGO Basics - Build tags and CGO_ENABLED
• Interop Decision Guide: CGO vs RPC vs Rewrite - Strategy comparison
• FFI Safety: Pointers, C.CString & Free - Risks when cgo is required
• WebAssembly Overview (see WebAssembly & TinyGo section) - Non-cgo deployment paths

Stack versions: This page was written for Go 1.26.x (Green Tea GC default, go fix modernizers - verify patch at build), chi (latest - verify at build), gin (latest - verify at build), echo (latest - verify at build), google.golang.org/grpc (latest - verify at build), sigs.k8s.io/controller-runtime (latest - verify at build), kubebuilder (latest - verify at build), tinygo (latest - verify board targets at build), wazero (latest - verify at build), and golangci-lint (latest - verify linter set at build).